Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for LockBit Leak Reveals ...

 Cyber News

A recent breach of the LockBit ransomware group’s infrastructure resulted in the leak of an internal database, revealing significant intelligence about the group’s operations. Cyble analyzed the leaked database in an advisory sent to clients this week, revealing interesting details about ransom payments, exploited   show more ...  

vulnerabilities and the structure of the ransomware group. On May 7, an unidentified actor compromised LockBit’s infrastructure and defaced the group’s dark web affiliate panels with the message: "Don't do crime CRIME IS BAD xoxo from Prague." The attacker also released a complete database—dumped on April 29, based on metadata—which revealed extensive details about LockBit’s Ransomware-as-a-Service (RaaS) operations from December 19 through the date of the data dump. LockBit was the most active ransomware group until a series of law enforcement actions slowed the group considerably beginning in February 2024, so the leaked database detailing the group’s inner workings is likely to further complicate comeback plans. LockBit Leak Exposed Affiliates, Chat Logs, Targets The leak exposed a total of 75 LockBit affiliate accounts, 246 victim organization chat logs, and almost 600 potential targets, which Cyble inferred from custom ransomware builders generated for specific domains. The leak also included communication logs, cryptocurrency transaction records, and affiliate-specific links, “which may help identify potential future connections between LockBit affiliates and other ransomware groups,” the Cyble advisory said. “The database provides unprecedented visibility into the inner workings of the LockBit ransomware operation, including their administration panel, affiliate program, victim management system, and ransom negotiation platform,” Cyble said. The 'users' table – one of 21 table in the database – contains 75 records of LockBit affiliates and operators, with login credentials, unencrypted passwords, permission levels, registration dates, and communication identifiers. The 'invites' table (3,693 records) documents the threatening invites sent to targeted organizations, including invitation codes and cryptocurrency wallet addresses for payment. The 'clients' table contains 246 records of victim organizations, including encryption status, ransom payment status, and negotiation records. 239 organizations logged into the platform, and 208 interacted in the chats. The database “reveals a consistent pattern of Initial victim profiling,” Cyble said. Build records with company_website and revenue fields are created before attack execution. Custom ransomware builds are created with company-specific configurations and unique encryption keys. The 'visits' table (2,398 records) tracks victim portal activities and engagement with the ransom demands. Multiple visit timestamps for the same client-id show patterns of victim engagement, often intensifying near payment deadlines. Cyble said 10-20% discounts are provided for fast payment, and payments are accepted only in BTC and Monero. A free decryptor is provided for Russia-based victims. Ransom Payment Rate Could Be Below 10% Only 18 chat logs included information indicating a ransom payment, which Cyble said suggests a payment rate of approximately 8.6% relative to the total number of victims. Of those chat logs, only two payments exceeded $100,000, while seven were under €10,000. The remaining nine payments fell between those two amounts, Cyble said. Nearly 60,000 Bitcoin wallet addresses belonging to LockBit affiliates identified in the leak may have been used to receive ransom payments from targeted organizations. The records contain details about payment status and affiliate commission distribution. The leak suggests that LockBit decrypts the encrypted data in a phased manner, as there were records indicating "decrypt_done", "decrypt_2_done", "decrypt_3_done", likely to maximize ransom collection, Cyble said. Connections with other ransomware group affiliates were also revealed in the data. The HellCat group, which recently announced its shutdown and the transfer of its brand, had been affiliated with LockBit since January 15, and chats revealed that affiliates of RansomHub joined the LockBit group amid uncertainty over RansomHub’s future. Possible Exploited Vulnerabilities In one of the chat exchanges, a LockBit affiliate confirmed that access to a victim's network was obtained through a vulnerability in FortiVPN, but the exact nature of the vulnerability could not be derived. In a chat exchange with one victim, a LockBit affiliate responded to the victim’s query about indicators of attack, mentioning exploiting several domain security issues, including weak passwords, exposed admin accounts, open ports, and missing backups. Analysis of 73 unique handler profiles and exposed contact details revealed potential aliases used by threat actors on underground forums, Cyble said. On XSS, one actor was seen expressing interest in Initial Access Brokers (IABs) and the exploitation of CVE-2024-55591 in FortiOS. Other notable activities include a clear focus on EDR evasion, phishing toolkits, Rust-based stealers, and delivery mechanisms such as .MSC files. The actor also demonstrated the use of reconnaissance tools like Shodan and Acunetix, suggesting a hands-on operational profile, Cyble said. Recent forum activity indicated one actor’s interest in acquiring corporate access and in vulnerabilities such as CVE-2024-3400. Other notable activities by the actor include advertising pentesting services, identifying IPs behind WAF or Cloudflare protection, and referencing exploitation of CVE-2023-3824 and CVE-2024-6387, “pointing to a technically capable actor with a focus on access facilitation and exploitation,” Cyble said. The leaked LockBit database shows that even as the list of most active ransomware groups changes, there is no shortage of technically capable affiliates ready to join the next leader.  

image for FBI Warns of AI Voic ...

 Cyber News

The Federal Bureau of Investigation (FBI) has released a public service announcement to warn individuals about a growing cyber threat involving text and voice messaging scams. Since April 2025, malicious actors have been impersonating senior U.S. government officials to target individuals, especially current or former   show more ...  

senior federal and state officials, as well as their contacts. The FBI is urging the public to remain vigilant and take steps to protect themselves from these schemes. So let's understand what exactly is happening? The FBI has disclosed a coordinated campaign involving smishing and vishing—two cyber techniques used to deceive people into revealing sensitive information or giving unauthorized access to their personal accounts. Smishing involves sending malicious text messages (via SMS or MMS) to lure recipients into clicking a fraudulent link or engaging in conversation. Vishing involves malicious voice messages, often enhanced with AI-generated audio, designed to sound like trusted figures, including high-ranking officials. These scams are aimed at building trust with the victims before tricking them into revealing personal data or granting access to sensitive accounts. Once access is gained, the attackers can impersonate the victim to deceive others in their network. Who Is Being Targeted? While the primary targets have been senior U.S. government officials, either currently in office or retired, their personal and professional contacts are also at risk. Attackers may use the trust and familiarity associated with known contacts to infiltrate broader networks. The goal is often to harvest personal information, obtain login credentials, or request money or sensitive data under false pretenses. In many cases, the attackers initiate contact under the guise of switching to another messaging platform, where they send malicious links or malware. Why It’s Dangerous This campaign is dangerous because: AI-generated voices make it difficult to distinguish between real and fake calls or voicemails. Attackers use publicly available data, such as photos and job titles, to make their messages more convincing. These tactics exploit human trust, making even tech-savvy individuals vulnerable. The FBI warns that the stolen credentials or information may be used to impersonate more officials, spread disinformation, or commit financial fraud. FBI Shares Common Signs of a Fake Message The FBI has shared several tips to help the public identify fake messages or voice calls: Verify the Sender: Do not trust a message or voice note just because it sounds official. Always look up the contact details from a known and trusted source, and verify the identity through a separate channel. Examine Details Closely: Look at the phone numbers, URLs, spelling, and message format. Scammers often change a single letter or number to make a message look legitimate. Check for AI Artifacts: In voice or video messages, watch for subtle flaws like distorted features, weird shadows, unusual voice lag, or strange speech patterns. These could be signs of AI-generated content. Listen for Tone and Language: Even if the voice sounds familiar, pay attention to word choice or phrases that seem out of character. AI-generated voices might mimic tone but often fail to capture personality or speech quirks accurately. When in Doubt, Reach Out: If something feels suspicious, contact your organization’s security team or the FBI for verification before taking any action. [caption id="attachment_102769" align="aligncenter" width="1024"] Source: FBI[/caption] So, How to Protect Yourself Here are practical steps recommended by the FBI to help prevent falling victim to these scams: Don’t Share Sensitive Info: Never share personal, financial, or contact information with someone you’ve only interacted with online or via phone. Verify New Contact Information: If someone you know reaches out using a new number or platform, confirm their identity through an existing channel before proceeding. Don’t Send Money to Unknown Contacts: Whether it’s a request for money, cryptocurrency, or gift cards, always double-check and confirm the legitimacy of such requests through independent means. Avoid Clicking Suspicious Links: Don’t click on any links or download attachments unless you’re absolutely sure of the sender’s identity. Use Two-Factor Authentication: Enable two-factor or multi-factor authentication wherever possible. It adds an extra layer of protection to your accounts. However, never share your two-factor authentication codes with anyone, even if they claim to be from your bank or a government agency. Set Up a Family Verification Phrase: Create a shared secret word or phrase with family members or close contacts. This can help verify identities in emergency situations. Be Careful What You Download: Only download apps or files from trusted sources. Never install anything based on unsolicited requests. Why It Matters Cyber threats continue to evolve, and this latest campaign demonstrates how sophisticated these schemes have become, especially with the use of AI voice cloning and realistic impersonations. The trust people place in familiar names or voices is being manipulated by malicious actors for gain. This type of cyberattack doesn't just threaten individuals—it can compromise national security if sensitive government data or communications are accessed or manipulated. What To Do If You’re Targeted If you believe you’ve been contacted as part of this campaign, or if you’ve already shared sensitive information, take immediate action: Stop communication with the suspected scammer. Report the incident to your organization’s security team or directly to the FBI via its Internet Crime Complaint Center (IC3) at www.ic3.gov. Change your passwords, enable multi-factor authentication, and monitor your accounts for suspicious activity. Warn your contacts if you suspect your account may have been compromised. Conclusion This campaign isn't just a tech issue, it is a reminder call. Threat actors are no longer relying on sloppy scams; they are exploiting trust, relationships, and even voices. The burden is now on individuals to be skeptical, to verify, and to pause before reacting. As these threats grow, so must our instincts. Awareness isn’t optional anymore—it’s survival.

image for Alkem’s Enzene Bio ...

 Cyber News

Alkem Laboratories Ltd has revealed that its wholly owned subsidiary, Enzene Biosciences, was the target of a cyberattack affecting its U.S. operations, which led to a fraudulent transfer of funds. The company disclosed the Enzene Biosciences cyberattack in a regulatory filing on Thursday, May 15, 2025.  According   show more ...  

to the statement submitted to the Bombay Stock Exchange (BSE) and the National Stock Exchange (NSE), the Enzene Biosciences cyberattack involved the compromise of business email accounts belonging to certain employees at its U.S. subsidiary. These compromised email IDs were exploited by unknown threat actors to facilitate an unauthorized financial transaction. The exact extent of the financial damage is still under investigation.  “We wish to inform you that our subsidiary Enzene Biosciences Limited (Enzene) has detected a cybersecurity incident at its US subsidiary, where business email IDs of certain employees at the US subsidiary were compromised. The incident resulted in a fraudulent transfer of funds,” the company stated in its formal notice.  The Enzene Biosciences Cyberattack Investigation   In response to the Enzene Biosciences data breach, Alkem Laboratories has enlisted independent cybersecurity firms to conduct a comprehensive investigation. These third-party agencies will perform a full forensic analysis of the breach and present a detailed report to the boards of both Enzene and Alkem.  Although the company has not disclosed the total value of the fraudulent transaction, internal teams are working in parallel with the external agencies to quantify the impact. The company is also in the process of filing complaints with the relevant regulatory and governmental bodies.  The Cyber Express has also reached out to the organization to learn more about this data breach. However, at the time of writing this, no official statement or response has been received.   Alkem Prioritizes Transparency and Governance  In a letter signed by Manish Narang, Alkem Laboratories emphasized its commitment to transparency. The board made a deliberate decision to publicly disclose the cyberattack on Enzene Biosciences, citing principles of good corporate governance.  “The Board of Directors of the Company has decided that in the interest of transparency and as a matter of good governance, this incident should be reported to the stock exchanges,” the letter read.  The data breach at Enzene Biosciences highlights the increasing risk of cyber threats in the pharmaceutical industry, which remains a lucrative target for cybercriminals. The method used—compromising employee emails—is part of a broader trend in Business Email Compromise (BEC) attacks. These attacks manipulate trusted communication channels to initiate unauthorized fund transfers.  While no intellectual property or clinical data has been reported stolen, the financial implications and reputational risk remain a matter of concern.   Conclusion  Enzene Biosciences, known for its innovation in biologics and biopharmaceutical manufacturing, is expected to cooperate fully with investigators and regulators as more details emerge. For Alkem Laboratories, this incident may prompt better organizational reviews of cybersecurity practices across all subsidiaries. The outcome of the ongoing investigation will be critical in determining next steps. This is an ongoing story, and The Cyber Express will be closely monitoring the situation. We’ll update this post once we have more information on the attack or any additional statement from the firm.

image for Google Chrome’s Ma ...

 Firewall Daily

Google has just rolled out a critical security and feature update for its widely used web browser, Google Chrome, and if you are one of the millions using it daily, this is not the kind of update you should miss. The new version—136.0.7103.113/.114 for Windows and macOS, and 136.0.7103.113 for Linux—started   show more ...  

rolling out via the Stable channel on May 14, 2025, and brings with it crucial patches for multiple security vulnerabilities, including the medium-severity CVE-2025-4372. This particular flaw, a “use-after-free” vulnerability in Chrome’s Web Audio module, could be used to crash your browser or even let attackers execute malicious code on your system. And it’s not the only one: the update also addresses CVE-2025-4664, a high-risk bug that is already being actively exploited in the wild, and CVE-2025-2783, the first confirmed zero-day vulnerability found in Chrome this year. Let us break that down. A zero-day means there was no time for users to patch the flaw before bad actors started using it, so the clock is ticking. Why CVE-2025-4664 Matters Google has confirmed that this update addresses four critical security vulnerabilities, including one that is actively being exploited. Among the most notable fixes is CVE-2025-4664, a high-severity vulnerability tied to insufficient policy enforcement in the Chrome Loader component.  Originally reported by security researcher @slonser_ on May 5, 2025, CVE-2025-4664 allows potential attackers to bypass Chrome's internal security policies. Exploiting this flaw could result in unauthorized code execution or even sandbox escapes. Google acknowledged active exploitation of the vulnerability in the wild and issued a security advisory encouraging users to update their browsers immediately.  In response, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-4664 to its Known Exploited Vulnerabilities Catalog and urged users and organizations to apply the patch by June 5, 2025.  Another key fix in this update is CVE-2025-4372, a medium-severity vulnerability categorized as a “use-after-free” issue in the Web Audio module. These types of vulnerabilities can potentially be exploited to crash systems or execute malicious code.  Google also addressed CVE-2025-2783, the first zero-day vulnerability discovered in Chrome this year. While details on its exploitation remain limited, it highlights the increasing frequency of zero-day threats in modern software ecosystems.  A fourth vulnerability, CVE-2025-4609, was reported by a researcher named Micky on April 22, 2025. This high-severity flaw stems from an incorrect handle provided in unspecified conditions within the Mojo IPC system. Like CVE-2025-4664, this vulnerability could be exploited to execute arbitrary code with user-level privileges, especially concerning users operating with administrative rights.  Google Chrome Performance and Feature Enhancements   Beyond security, Chrome version 136.0.7103.113/.114 introduces several performance improvements and user-facing features. Notable backend enhancements include more efficient rendering processes and better memory management, designed to streamline overall browser performance. Chrome users can also expect new features such as updates to the TabGroupHeader accessible name and improved behavior in popover-focus functionality, both of which aim to refine user navigation and accessibility.  Additionally, developers have resolved bugs that were causing crashes in the AddToTopLayer function and issues with the Update button in chrome://extensions, contributing to a more stable browsing experience.  What You Should Do If you’re running a version of Google Chrome older than 136.0.7103.113, it’s time to update immediately. Google strongly advises both individual users and organizations to apply the patch to stay protected. Unpatched browsers are easy targets, especially when flaws like CVE-2025-4372 and CVE-2025-4664 are known and actively being probed by attackers. Recommendation One Must Follow: Enabling automatic updates so patches are applied as soon as they’re available. Using browsers and software that are fully supported and actively maintained. Employing regular vulnerability assessments in enterprise environments to catch outdated software versions before attackers do. Conclusion  It is strongly recommended that users and organizations apply the patch without delay and implement automated patching procedures regularly. It is equally important to use only fully supported and up-to-date browsers and email clients to minimize exposure to threats. Google acknowledged the critical role of external researchers in identifying issues such as CVE-2025-4372, CVE-2025-4664, and CVE-2025-2783—some of which were uncovered using advanced tools like AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, libFuzzer, and AFL. 

image for Smishing and Vishing ...

 Cyber News

Have you ever received a text that looked urgent—maybe a missed delivery, a banking transaction alert, or even a message from your boss—only to realize later it was a scam? Or a phone call from what sounded like your bank relationship manager… but wasn’t? Welcome to 2025, where smishing and vishing attacks   show more ...  

have grown far beyond poorly written messages and robotic voices. Thanks to artificial intelligence (AI), scammers are now becoming more convincing than ever—and making billions from it. Last year alone, vishing incidents surged by 30% globally, racking up a staggering $1.2 billion in losses. In the Asia-Pacific region, it's even worse: targeted email attacks rose nearly 27%, while deepfake scams surged by 1,530% between 2022 and 2023. And the trend isn’t slowing. 168 million phone-based scams were reported last year in Thailand alone. That's not just a statistic—it's a wake-up call. From AI-powered voice cloning used in voice phishing techniques to realistic fake text alerts crafted by bots, AI-generated scams are rewriting the cybercrime world. What were once obvious frauds are now becoming social engineering threats, blending technology with psychology to deceive even the most tech-savvy users. In this article, we will break down how smishing and vishing threats are evolving in 2025 and show you how to spot and stop them before you become the next victim. What Are Smishing and Vishing? Think of them as modern twists on old-school phishing—but made for your phone. Smishing is when cybercriminals send fake SMS or text messages designed to trick you into clicking a malicious link or revealing sensitive data. A typical smishing example in 2025 might look like a delivery update, a bank alert, or even a message pretending to be from a government agency. On the other hand, vishing—short for "voice phishing"—involves phone calls or voicemails where attackers use deceptive voice phishing techniques, often powered by AI-generated scams, to sound like real people or officials. What makes both attacks dangerous today is their ability to play on human emotions—urgency, fear, or trust—turning them into powerful social engineering threats. They don’t need to break into your device; they just need you to believe the lie. How AI Supports Scams Cybercriminals are no longer just sending vague texts or making fake calls—they're using AI-generated scams to take deception to a whole new level. Imagine being on a Zoom call with your company’s CFO and a few coworkers, only to later find out none of them were real. That’s exactly what happened to a finance employee in Hong Kong, who was tricked into wiring $25 million after attending a deepfake video call with what looked and sounded like his real colleagues. It’s an example of how voice phishing techniques and synthetic video are being used to mimic trusted individuals, blending deepfakes with smishing and vishing attacks to create the perfect storm of social engineering threats. And it doesn’t stop there. In one of the biggest pyramid schemes of 2024, a scam called MetaMax used an AI-generated CEO avatar to attract victims into investing in fake returns on social media content. These scams are also growing into emotional manipulation machines. Take "pig butchering scams," where fraudsters use chatbots and AI-powered interactions to build months of fake relationships—then slowly convince victims to hand over their life savings. These aren’t your old-school cons. They’re smart, believable, and terrifyingly real. And as smishing examples in 2025 show, it only takes one convincing message or call to fall for them. Why Are Smishing and Vishing Attacks So Effective The short answer to this is, cybercriminal hijack human psychology, and AI makes them terrifyingly convincing. Today’s AI-generated scams are no longer messy or easy to spot—they’re precise, emotional, and realistic. Take, for instance, the finance worker in Hong Kong who transferred $25 million during a video call with people he thought were his CFO and team. They looked and sounded real, but were AI-powered deepfakes. That’s how far voice phishing techniques have come. It’s all about trust and urgency. These scams are designed to trigger panic—“Your account has been compromised!” or “This is a secret transaction”—so you act before thinking. This emotional hijacking is what makes social engineering threats so powerful. Just look at the rise in smishing examples in 2025, where fake texts from banks, couriers, or even government agencies trick people into clicking malicious links. Or the infamous MetaMax scam, which used an AI-generated CEO to front a $200 million fraud. Add in tactics like the "pig butchering" scam, where scammers build emotional trust before pushing fake investments, and it’s easy to see how victims get pulled in. It’s not just what you see or hear—it’s what you believe. And that’s exactly what cybercriminals are exploiting. Red Flags to Watch for Spotting AI-Powered Smishing and Vishing Scams When it comes to spotting smishing and vishing attacks, the red flags are there—you just have to know what to look for. One of the most common signs? Spoofed numbers. If you get a call or text that looks like it’s from your bank or a government agency but something feels off, trust your gut. Cybercriminals now use AI-generated scams to mimic real voices and craft super-convincing messages that sound urgent or emotionally charged. Another clue is links that seem weird. A classic smishing example in 2025 might be a message saying, “Your package is on hold—click here to verify,” with a sketchy-looking URL that doesn’t match the sender. These attackers rely heavily on voice phishing techniques and texts that trick you into acting fast—before you think. If anything sounds too urgent, or too good to be true, it probably is. These are classic social engineering threats designed to manipulate your trust. Always pause, verify, and never share sensitive info without double-checking through trusted sources. Protect Yourself from Smishing and Vishing Attacks in 2025 Let’s face it, smishing and vishing attacks are getting trickier, especially now that scammers are using AI-generated scams to sound and look more convincing than ever. That "urgent" text from your bank? Or the call that sounds just like your boss? Chances are, it could be a trap. The best way to protect yourself is by slowing down and verifying. Never click on links in suspicious texts—even if they look official. If you're unsure, visit the website directly or call the institution using a verified number. When it comes to voice calls, voice phishing techniques have advanced so much that you should never share sensitive info just because a caller “sounds right.” Instead, hang up and call back using an official line. Learn to recognize smishing examples in 2025, like fake delivery alerts or tax refund messages, and train yourself to question urgency. These tactics prey on human instincts, which is why staying calm and skeptical is your best defense against social engineering threats. A good thumb rule? If it feels off, it probably is. Conclusion The convenience of tech comes with a price: heightened social engineering threats that demand constant awareness. Don't trust a message just because it sounds urgent or a voice because it sounds familiar. Always verify unfamiliar messages or calls through official channels you already trust. Avoid clicking on suspicious links, and never share sensitive information over text or phone without double-checking the source. Keep your devices updated, enable multi-factor authentication, and treat every unexpected communication with healthy skepticism. Because in today’s cyber world, a pause to verify can save you from a lifetime of regret.

image for Ransomware group use ...

 Business

The ransomware group Interlock has started using the ClickFix technique to gain access to its victims infrastructure. In a recent post, we discussed the general concept of ClickFix. Today well look at a specific case where a ransomware group has put this tactic into action. Cybersecurity researchers have discovered   show more ...  

that Interlock is using a fake CAPTCHA imitating a Cloudflare-protected site on a page posing as the website of Advanced IP Scanner — a popular free network scanning tool. This suggests the attack is aimed at IT professionals working in organizations of potential interest to the group. How Interlock is using ClickFix to spread malware The Interlock attackers lure victims to a webpage with an URL mimicking that of the official Advanced IP Scanner site. The researchers found multiple instances of this same page hosted at different addresses across the web. When the user clicks the link, they see a message asking them to complete a CAPTCHA, seemingly provided by Cloudflare. The message states that Cloudflare helps companies regain control of their technology. This legitimate-looking marketing text is in fact copied from Cloudflares own What is Cloudflare? webpage. Its followed by instructions to press Win + R, then Ctrl + V, and finally Enter. Next come two buttons: Fix it and Retry. Finally, a message claims that the resource the victim is trying to access needs to verify the connections security. In reality, when the victim clicks Fix it, a malicious PowerShell command is copied to the clipboard. The user then unknowingly opens the command console with Win + R and pastes the command with Ctrl + V. Pressing Enter then executes the malicious command. Executing the command downloads and launches a 36-megabyte fake PyInstaller installer file. And to distract the victim, a browser window with the real Advanced IP Scanner website opens. From data collection to extortion: the stages of an Interlock attack Once the fake installer is launched, a PowerShell script is activated that collects system information and sends it to a C2 server. In response, the server can either send the ooff command to terminate the script, or deliver additional malware. In this case the attackers used Interlock RAT (remote access Trojan) as the payload. The malware is saved in the %AppData% folder and runs automatically, allowing the attackers to access confidential data and establish persistence in the system. After initial access, the Interlock operators try to use previously stolen or leaked credentials and the Remote Desktop Protocol (RDP) for lateral movement. Their primary target is the domain controller (DC) — gaining access to it allows the attackers to spread malware across the infrastructure. The final step before launching the ransomware is to steal the victim organizations valuable data. These files are uploaded to Azure Blob Storage controlled by the attackers. After exfiltrating the sensitive data, the Interlock group publishes it on a new Tor domain. A link to this domain is then provided in a new post on the groups .onion site. Example of a ransom note sent by the Interlock ransomware group. Source How to protect against ClickFix attacks ClickFix and other similar techniques rely heavily on social engineering, so the best protection is a systematic approach focused primarily on raising employee awareness. To help with this, we recommend our Kaspersky Automated Security Awareness Platform, which automates training programs for staff. In addition, to protect against ransomware attacks, we recommend the following: Installing reliable protection on all corporate devices. Monitoring for suspicious activity in the corporate network using an XDR-class solution. If your in-house security team lacks the resources or expertise, using an external service for threat hunting and response.

 Feed

Researchers at ETH Zürich have discovered yet another security flaw that they say impacts all modern Intel CPUs and causes them to leak sensitive data from memory, showing that the vulnerability known as Spectre continues to haunt computer systems after more than seven years. The vulnerability, referred to as Branch Privilege Injection (BPI), "can be exploited to misuse the prediction

 Feed

Cybersecurity researchers have shed light on a new malware campaign that makes use of a PowerShell-based shellcode loader to deploy a remote access trojan called Remcos RAT. "Threat actors delivered malicious LNK files embedded within ZIP archives, often disguised as Office documents," Qualys security researcher Akshay Thorve said in a technical report. "The attack chain leverages mshta.exe for

 Feed

Modern apps move fast—faster than most security teams can keep up. As businesses rush to build in the cloud, security often lags behind. Teams scan code in isolation, react late to cloud threats, and monitor SOC alerts only after damage is done. Attackers don’t wait. They exploit vulnerabilities within hours. Yet most organizations take days to respond to critical cloud alerts. That delay isn’t

 Feed

Cybersecurity researchers are calling attention to a new botnet malware called HTTPBot that has been used to primarily single out the gaming industry, as well as technology companies and educational institutions in China. "Over the past few months, it has expanded aggressively, continuously leveraging infected devices to launch external attacks," NSFOCUS said in a report published this week. "By

 Feed

Data is the lifeblood of productivity, and protecting sensitive data is more critical than ever. With cyber threats evolving rapidly and data privacy regulations tightening, organizations must stay vigilant and proactive to safeguard their most valuable assets. But how do you build an effective data protection framework? In this article, we'll explore data protection best practices from meeting

 'Virus'

Source: securelist.com – Author: Kaspersky ICS CERT Trends Relative stability from quarter to quarter. The percentage of ICS computers on which malicious objects were blocked remained unchanged from Q4 2024 at 21.9%. Over the last three quarters, the value has ranged from 22.0% to 21.9%. The quarterly figures   show more ...  

are decreasing from year to year. Since […] La entrada Threat landscape for industrial automation systems in Q1 2025 – Source: securelist.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . Modern apps move fast—faster than most security teams can keep up. As businesses rush to build in the cloud, security often lags behind. Teams scan code in isolation, react late to cloud threats, and monitor SOC alerts only after damage is done. Attackers don’t wait.   show more ...  

They exploit vulnerabilities within hours. […] La entrada [Webinar] From Code to Cloud to SOC: Learn a Smarter Way to Defend Modern Applications – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Kristina Beek, Associate Editor, Dark Reading Please enable cookies. Sorry, you have been blocked You are unable to access darkreading.com Why have I been blocked? This website is using a security service to protect itself from online attacks. The action you just performed   show more ...  

triggered the security solution. There are several actions […] La entrada Big Steelmaker Halts Operations After Cyber Incident – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Nate Nelson, Contributing Writer Please enable cookies. Sorry, you have been blocked You are unable to access darkreading.com Why have I been blocked? This website is using a security service to protect itself from online attacks. The action you just performed triggered the   show more ...  

security solution. There are several actions that could […] La entrada International Crime Rings Defraud US Gov’t Out of Billions – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Attackers

Source: www.darkreading.com – Author: Alexander Culafi, Senior News Writer, Dark Reading Please enable cookies. Sorry, you have been blocked You are unable to access darkreading.com Why have I been blocked? This website is using a security service to protect itself from online attacks. The action you just   show more ...  

performed triggered the security solution. There are several […] La entrada Attackers Target Samsung MagicINFO Server Bug, Patch Now – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Critical

Source: www.darkreading.com – Author: Kristina Beek, Associate Editor, Dark Reading Please enable cookies. Sorry, you have been blocked You are unable to access darkreading.com Why have I been blocked? This website is using a security service to protect itself from online attacks. The action you just performed   show more ...  

triggered the security solution. There are several actions […] La entrada Critical SAP NetWeaver Vuln Faces Barrage of Cyberattacks – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Amir Khayat Please enable cookies. Sorry, you have been blocked You are unable to access darkreading.com Why have I been blocked? This website is using a security service to protect itself from online attacks. The action you just performed triggered the security solution.   show more ...  

There are several actions that could trigger this […] La entrada RSAC 2025: AI Everywhere, Trust Nowhere – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Please enable cookies. Sorry, you have been blocked You are unable to access darkreading.com Why have I been blocked? This website is using a security service to protect itself from online attacks. The action you just performed triggered the security solution. There are   show more ...  

several actions that could trigger this block including […] La entrada RealDefense Partner Program Surpasses $100M in Annual Revenue – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.troyhunt.com – Author: Troy Hunt 16 May 2025 Today, we welcome the 40th government onboarded to Have I Been Pwned’s free gov service, Malaysia. The NC4 NACSA (National Cyber Coordination and Command Centre of the National Cyber Security Agency) in Malaysia now has full access to query all   show more ...  

their government domains via API, and […] La entrada Welcoming the Malaysian Government to Have I Been Pwned – Source: www.troyhunt.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 cyber risk

Source: www.darkreading.com – Author: Arielle Waldman Please enable cookies. Sorry, you have been blocked You are unable to access darkreading.com Why have I been blocked? This website is using a security service to protect itself from online attacks. The action you just performed triggered the security   show more ...  

solution. There are several actions that could trigger this […] La entrada Cyber-Risk Calculator Takes the Guesswork Out of Assessment – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 A Little Sunshine

Source: krebsonsecurity.com – Author: BrianKrebs In what experts are calling a novel legal outcome, the 22-year-old former administrator of the cybercrime community Breachforums will forfeit nearly $700,000 to settle a civil lawsuit from a health insurance company whose customer data was posted for sale on the   show more ...  

forum in 2023. Conor Brian Fitzpatrick, a.k.a. “Pompompurin,” is […] La entrada Breachforums Boss to Pay $700k in Healthcare Breach – Source: krebsonsecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CISOs

Source: go.theregister.com – Author: Robin Birtstone Sponsored feature From the written word through to gunpowder and email, whenever an enabling technology comes along, you can be sure someone will be ready to use it for evil. Most tech is dual-use, and AI is no exception. On the one side are people using it   show more ...  

to find […] La entrada From hype to harm: 78% of CISOs see AI attacks already – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Iain Thomson The FBI has warned that fraudsters are impersonating “senior US officials” using deepfakes as part of a major fraud campaign. According to the agency, the campaign has been running since April and most of the messages target former and current US   show more ...  

government officials. The attackers are after login details […] La entrada Scammers are deepfaking voices of senior US government officials, warns FBI – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Jessica Lyons A former DoorDash driver has pleaded guilty to participating in a $2.59 million scheme that used fake accounts, insider access to reassign orders, and bogus delivery reports to trigger payouts for food that was never delivered. Sayee Chaitanya Reddy Devagiri,   show more ...  

30, of Newport Beach, California, pleaded guilty on Tuesday […] La entrada DoorDash scam used fake drivers, phantom deliveries to bilk $2.59M – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 cyber

Source: go.theregister.com – Author: Jessica Lyons Interview The same miscreants behind recent cyberattacks on British retailers are now trying to dig their claws into major American retailers’ IT environments – and in some cases even deploying ransomware, according to Google. The cloud giant’s   show more ...  

threat-intel nerve-center Mandiant suspects the Scattered Spider (aka UNC3944) gang is behind […] La entrada Cyber fiends battering UK retailers now turn to US stores – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Coinbase

Source: go.theregister.com – Author: Connor Jones Coinbase says some of its overseas support staff were paid off to steal information on behalf of cybercriminals, and the company is now being extorted for $20 million. According to a filing with the Securities and Exchange Commission (SEC) on Thursday, “an   show more ...  

unknown threat actor” contacted the crypto exchange […] La entrada Coinbase extorted for $20M. Support staff bribed. Customers scammed. One hell of a SNAFU – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Thomas Claburn In its latest gambit to reduce the noise of unnecessary security alerts, Socket has acquired Coana, a startup founded in 2022 by researchers from Aarhus University in Denmark that tells users which vulnerabilities they can safely ignore. “The problem   show more ...  

with all security tools – and this is not something […] La entrada Socket buys Coana to tell you which security alerts you can ignore – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Jessica Lyons interview Being the chief information security officer at Snowflake is never an easy job, but last spring it was especially challenging. In May 2024, some of the cloud storage and data analytics firm’s major customers, including Ticketmaster and banking   show more ...  

giant Santander, disclosed significant data breaches. Attackers, the companies reported, […] La entrada Snowflake CISO on the power of ‘shared destiny’ and ‘yes and’ – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0CISO2CISO

Congratulations to the recipients of the 2025 WE Local Collegiate Competition awards! Find their names and research topics in this article. Source Views: 0 La entrada 2025 WE Local Collegiate Competition Results se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.securityweek.com – Author: Eduard Kovacs American steel giant Nucor Corporation (NYSE: NUE) revealed on Wednesday that production has been disrupted due to a cyberattack. Nucor, which advertises itself as the largest steel manufacturer and recycler in North America, informed the SEC that it recently   show more ...  

detected a cybersecurity incident involving unauthorized access to its IT […] La entrada Production at Steelmaker Nucor Disrupted by Cyberattack – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 acquires

Source: www.securityweek.com – Author: Eduard Kovacs Enterprise cybersecurity giant Proofpoint announced on Thursday that it’s acquiring Germany-based Hornetsecurity, a company specializing in Microsoft 365 security solutions. Financial terms of the deal have not been officially disclosed, but CNBC reported   show more ...  

that Proofpoint is acquiring the European competitor for $1 billion. SecurityWeek has asked Proofpoint for confirmation […] La entrada Proofpoint to Acquire Hornetsecurity in Reported $1 Billion Deal – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: hackread.com – Author: Waqas. The beginning of Pwn2Own Berlin 2025, hosted at the OffensiveCon conference, has concluded its first two days with notable achievements in cybersecurity research. A total of $695,000 has been awarded for 39 unique zero-day vulnerabilities, with the final day scheduled for   show more ...  

Saturday, May 17. Day One: Major Exploits and AI […] La entrada Pwn2Own Berlin 2025: Windows 11, VMware, Firefox and Others Hacked – Source:hackread.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0day

Source: hackread.com – Author: Deeba Ahmed. Ivanti EPMM users urgently need to patch against actively exploited 0day vulnerabilities (CVE-2025-4427, CVE-2025-4428) that enable pre-authenticated remote code execution, warns watchTowr. Cybersecurity researchers at watchTowr have shared details of two security   show more ...  

vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM) software, identified as CVE-2025-4427 and CVE-2025-4428 that can be combined […] La entrada Ivanti EPMM Hit by Two Actively Exploited 0day Vulnerabilities – Source:hackread.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: hackread.com – Author: Deeba Ahmed. ReversingLabs discovers dbgpkg, a fake Python debugger that secretly backdoors systems to steal data. Researchers suspect a pro-Ukraine hacktivist group is behind the attack on the PyPI repository especially those used by Russian developers. Cybersecurity researchers   show more ...  

at ReversingLabs (RL) have discovered a new malicious Python package, named dbgpkg, that […] La entrada Pro-Ukraine Group Targets Russian Developers with Python Backdoor – Source:hackread.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: hackread.com – Author: Deeba Ahmed. Hackers from the Scattered Spider group, known for UK retail attacks, are now targeting US retailers, Google cybersecurity experts have warned. The notorious cybercriminal group Scattered Spider is now actively targeting retail companies in the United States,   show more ...  

following a string of disruptive attacks against similar businesses in the United […] La entrada Hackers Now Targeting US Retailers After UK Attacks, Google – Source:hackread.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . Cybersecurity researchers are calling attention to a new botnet malware called HTTPBot that has been used to primarily single out the gaming industry, as well as technology companies and educational institutions in China. “Over the past few months, it has expanded   show more ...  

aggressively, continuously leveraging infected devices to launch external attacks,” […] La entrada New HTTPBot Botnet Launches 200+ Precision DDoS Attacks on Gaming and Tech Sectors – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . Data is the lifeblood of productivity, and protecting sensitive data is more critical than ever. With cyber threats evolving rapidly and data privacy regulations tightening, organizations must stay vigilant and proactive to safeguard their most valuable assets. But how do   show more ...  

you build an effective data protection framework? In this article, […] La entrada Top 10 Best Practices for Effective Data Protection – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . Researchers at ETH Zürich have discovered yet another security flaw that they say impacts all modern Intel CPUs and causes them to leak sensitive data from memory, showing that the vulnerability known as Spectre continues to haunt computer systems after more than seven   show more ...  

years. The vulnerability, referred to as Branch […] La entrada Researchers Expose New Intel CPU Flaws Enabling Memory Leaks and Spectre v2 Attacks – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . Cybersecurity researchers have shed light on a new malware campaign that makes use of a PowerShell-based shellcode loader to deploy a remote access trojan called Remcos RAT. “Threat actors delivered malicious LNK files embedded within ZIP archives, often disguised as   show more ...  

Office documents,” Qualys security researcher Akshay Thorve said in a […] La entrada Fileless Remcos RAT Delivered via LNK Files and MSHTA in PowerShell-Based Attacks – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.lastwatchdog.com – Author: bacohido By Byron V. Acohido The SOC has long been the enterprise’s first line of defense. But despite years of investment in threat feeds and automation platforms, the same question persists: why does intelligence still struggle to translate into timely action? Related:   show more ...  

IBM makes the AI speed argument for SOCs The […] La entrada SHARED INTEL Q&A: AI in the SOC isn’t all about speed — it’s more so about smoothing process – Source: www.lastwatchdog.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.lastwatchdog.com – Author: bacohido By Doni Brass Small businesses make up 90% of all companies worldwide and account for half of global GDP. Yet despite their importance, many lack the cybersecurity expertise and resources to fend off a rising tide of digital threats. Related: Protecting lateral   show more ...  

networks in SMBs Rich in sensitive data and […] La entrada GUEST ESSAY: Cybercrime for hire: small businesses are the new bullseye of the Dark Web – Source: www.lastwatchdog.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

2025-05
Aggregator history
Friday, May 16
THU
FRI
SAT
SUN
MON
TUE
WED
MayJuneJuly