Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Starlink Outage Spar ...

 Cyber News

SpaceX’s Starlink internet service suffered a major international outage, disconnecting tens of thousands of users for over two hours. The Starlink outage began around 3 p.m. Eastern Time (19:00 GMT), according to reports on Downdetector, with over 61,000 users submitting complaints in a matter of minutes. The issue   show more ...  

lasted approximately 2.5 hours and, as confirmed by Starlink’s Vice President of Engineering Michael Nicolls, was caused by the “failure of key internal software services that operate the core network.” “We apologize for the temporary disruption in our service; we are deeply committed to providing a highly reliable network, and will fully root cause this issue and ensure it does not occur again,” Nicolls posted on X (formerly Twitter). [caption id="attachment_104164" align="aligncenter" width="588"] Source: X[/caption] SpaceX CEO Elon Musk echoed the apology: “Sorry for the outage. SpaceX will remedy root cause to ensure it doesn’t happen again,” he wrote on the platform he also owns. Starlink Outage, More Than Just a Blip Although the incident was resolved relatively quickly, it has left a unanswered questions among users and industry watchers. Starlink, which serves over six million users across more than 140 countries and territories, has long been praised for its reliability, especially in remote and underserved areas. But this Startling outage incident highlighted a potential Achilles’ heel: overdependence on centralized software systems in a network that is otherwise highly distributed. For a service that’s marketed as resilient and increasingly mission-critical, especially for rural users, transportation systems, emergency responders, and even military operations, a network failure of this magnitude is not just a technical glitch. It’s a trust issue. And trust, in the satellite internet game, is everything. Speculations Run Wild While the company has attributed the issue to internal software service failures, the nature of the outage has triggered speculation ranging from failed software updates to possible cyberattacks. In a time when even highly secure networks are being targeted globally, any unexplained service disruption of this scale inevitably leads to broader cybersecurity concerns. To SpaceX’s credit, the communication has been transparent, prompt updates from top executives, including Musk himself, are a rarity in such scenarios. But that hasn’t stopped critics from pointing out the inherent risk in building global infrastructure that still relies on software systems vulnerable to failure. The Growing Pains of a Global Ambition Since 2020, SpaceX has launched more than 8,000 Starlink satellites into low-Earth orbit, creating a vast constellation aimed at providing internet coverage anywhere on Earth. The network has expanded at a pace few expected, winning over consumers with its performance in areas poorly served by traditional fiber or cable networks. More recently, Starlink has focused on upgrading its infrastructure to meet rising demand for speed and bandwidth. The company has also teamed up with T-Mobile to provide direct-to-cell satellite services, allowing users to send text messages even in areas with no cellular coverage. Larger and more advanced satellites are being introduced to support this new service line. All this makes the outage even more concerning. As Starlink becomes more integrated into essential services, from emergency response to military communications, it simply cannot afford downtime, certainly not on this scale. Elon Musk’s Focus Shifts to Vine, Not Starlink Outage Interestingly, while Starlink engineers scrambled to get the service back online, Elon Musk took to X with a completely different announcement: the revival of Vine. Yes, the six-second video app that once ruled short-form video before TikTok was even a thing. “Vine will return—in AI form,” Musk posted, nearly nine years after the platform was shuttered by Twitter in 2017 due to monetization struggles. Vine was a ground for viral content and internet stardom. Its return, particularly powered by artificial intelligence (AI), hints at Musk’s broader ambitions for X to be more than a microblogging site. But the timing raised eyebrows. On the one hand, Starlink, a core SpaceX business, is facing serious reliability scrutiny. On the other, Musk is teasing flashy AI-powered social media experiments. It’s a plain contrast in priorities, and not everyone is convinced that both can coexist without one being neglected. Why This Story Matters This is not just about a temporary Starlink outage. It’s about the resilience and readiness of next-gen infrastructure that is increasingly being positioned as the future of global internet access. As services like Starlink become deeply embedded in our everyday lives and critical sectors, their reliability is no longer optional, it’s foundational. The Starlink Outage incident also sheds light on the broader question of how much faith we place in single points of failure, even in supposedly decentralized systems. Whether it’s an internal software flaw or a vulnerability waiting to be exploited, this event should be a wake-up call for both providers and users.

image for Hijacking Discord in ...

 Threats

Attackers are using expired and deleted Discord invite links to distribute two strains of malware: AsyncRAT for taking remote control of infected computers, and Skuld Stealer for stealing crypto wallet data. They do this by exploiting a vulnerability in Discords invite link system to stealthily redirect users from   show more ...  

trusted sources to malicious servers. The attack leverages the ClickFix technique, multi-stage loaders and deferred execution to bypass defenses and deliver malware undetected. This post examines in detail how attackers exploit the invite link system, what is ClickFix and why they use it, and, most importantly, how not to fall victim to this scheme. How Discord invite links work First, lets look at how Discord invite links work and how they differ from each other. By doing so, well gain an insight into how the attackers learned to exploit the link creation system in Discord. Discord invite links are special URLs that users can use to join servers. They are created by administrators to simplify access to communities without having to add members manually. Invite links in Discord can take two alternative formats: https://discord.gg/{invite_code} https://discord.com/invite/{invite_code} Having more than one format, with one that uses a meme domain, is not the best solution from a security viewpoint, as it sows confusion in the users minds. But thats not all. Discord invite links also have three main types, which differ significantly from each other in terms of properties: Temporary invite links Permanent invite links Custom invite links (vanity URLs) Links of the first type are what Discord creates by default. Moreover, in the Discord app, the server administrator has a choice of fixed invite expiration times: 30 minutes, 1 hour, 6 hours, 12 hours, 1 day or 7 days (the default option). For links created through the Discord API, a custom expiration time can be set — any value up to 7 days. Codes for temporary invite links are randomly generated and usually contain 7 or 8 characters, including uppercase and lowercase letters, as well as numbers. Examples of a temporary link: https://discord.gg/a7X9pLd https://discord.gg/Fq5zW2cn To create a permanent invite link, the server administrator must manually select Never in the Expire After field. Permanent invite codes consist of 10 random characters — uppercase and lowercase letters, and numbers, as before. Example of a permanent link: https://discord.gg/hT9aR2kLmB Lastly, custom invite links (vanity links) are available only to Discord Level 3 servers. To reach this level, a server must get 14 boosts, which are paid upgrades that community members can buy to unlock special perks. Thats why popular communities with an active audience — servers of bloggers, streamers, gaming clans or public projects — usually attain Level 3. Custom invite links allow administrators to set their own invite code, which must be unique among all servers. The code can contain lowercase letters, numbers and hyphens, and can be almost arbitrary in length — from 2 to 32 characters. A server can have only one custom link at any given time. Such links are always permanent — they do not expire as long as the server maintains Level 3 perks. If the server loses this level, its vanity link becomes available for reuse by another server with the required level. Examples of a custom invite link: https://discord.gg/alanna-titterington https://discord.gg/best-discord-server-ever https://discord.gg/fq5zw2cn From this last example, attentive readers may guess where were heading. How scammers exploit the invite system Now that weve looked at the different types of Discord invite links, lets see how malicious actors weaponize the mechanism. Note that when a regular, non-custom invite link expires or is deleted, the administrator of a legitimate server cannot get the same code again, since all codes are generated randomly. But when creating a custom invite link, the server owner can manually enter any available code, including one that matches the code of a previously expired or deleted link. It is this quirk of the invite system that attackers exploit: they track legitimate expiring codes, then register them as custom links on their servers with Level 3 perks. As a result, scammers can use: Any expired temporary invite links (even if the expired link has capital letters and the scammers custom URL replaces them with lowercase, the system automatically redirects the user to this vanity URL) Permanent invite links deleted from servers, if the code consisted solely of lowercase letters and numbers (no redirection here) Custom invite links, if the original server has lost Level 3 perks and its link is available for re-registration What does this substitution lead to? Attackers get the ability to direct users who follow links previously posted on wholly legitimate resources (social networks, websites, blogs and forums of various communities) to their own malicious servers on Discord. Whats more, the legal owners of these resources may not even realize that the old invite links now point to fake Discord servers set up to distribute malware. This means they cant even warn users that a link is dangerous, or delete messages in which it appears. How ClickFix works in Discord-based attacks Now lets talk about what happens to users who follow hijacked invite links received from trusted sources. After joining the attackers Discord server, the user sees that all channels are unavailable to them except one, called verify. On the attackers Discord server, users who followed the hijacked link have access to only one channel, verify Source This channel features a bot named Safeguard that offers full access to the server. To get this, the user must click the Verify button, which is followed by a prompt to authorize the bot. On clicking the Authorize button, the user is automatically redirected to the attackers external site, where the next and most important phase of the attack begins. Source After authorization, the bot gains access to profile information (username, avatar, banner), and the user is redirected to an external site: https://captchaguard[.]me. Next, the user goes through a chain of redirects and ends up on a well-designed web page that mimics the Discord interface, with a Verify button in the center. Redirection takes the user to a fake page styled to look like the Discord interface. Clicking the Verify button activates malicious JavaScript code that copies a PowerShell command to the clipboard Source Clicking the Verify button activates JavaScript code that copies a malicious PowerShell command to the clipboard. The user is then given precise instructions on how to pass the check?: open the Run window (Win + R), paste the clipboarded text (Ctrl + C), and click Enter. Next comes the ClickFix technique: the user is instructed to paste and run the malicious command copied to the clipboard in the previous step. Source The site does not ask the user to download or run any files manually, thereby removing the typical warning signs. Instead, users essentially infect themselves by running a malicious PowerShell command that the site slips onto the clipboard. All these steps are part of an infection tactic called ClickFix, which weve already covered in depth on our blog. AsyncRAT and Skuld Stealer malware The user-activated PowerShell script is the first step in the multi-stage delivery of the malicious payload. The attackers next goal is to install two malicious programs on the victims device — lets take a closer look at each of them. First, the attackers download a modified version of AsyncRAT to gain remote control over the infected system. This tool provides a wide range of capabilities: executing commands and scripts, intercepting keystrokes, viewing the screen, managing files, and accessing the remote desktop and camera. Next, the cybercriminals install Skuld Stealer on the victims device. This crypto stealer harvests system information, siphons off Discord login credentials and authentication tokens saved in the browser, and, crucially, steals seed phrases and passwords for Exodus and Atomic crypto wallets by injecting malicious code directly into their interface. Skuld sends all collected data via a Discord webhook — a one-way HTTP channel that allows applications to automatically send messages to Discord channels. This provides a secure way for stealing information directly in Discord without the need for a sophisticated management infrastructure. As a result, all data — from passwords and authentication tokens to crypto wallet seed phrases — is automatically published in a private channel set up in advance on the attackers Discord server. Armed with the seed phrases, the attackers can recover all the private keys of the hijacked wallets and gain full control over all cryptocurrency assets of their victims. How to avoid falling victim? Unfortunately, Discords invite system lacks transparency and clarity. And this makes it extremely difficult, especially for newbies, to spot the trick before clicking a hijacked link and during the redirection process. Nevertheless, there are some security measures that, if done properly, should fend off the worst outcome — a malware-infected computer and financial losses: Never paste code into the Run window if you dont know exactly what it does. Doing this is extremely dangerous, and normal sites will never give such an instruction. Configure Discord privacy and security by following our detailed guide. This will not guard against hijacked invite links, but will minimize other risks associated with Discord. Use a reliable security solution that gives advance warning of danger and prevents the download of malware. Its best to install it on all devices, but especially on ones where you use crypto wallets and other financial software. Malicious actors often target Discord to steal cryptocurrency, game accounts and assets, and generally cause misery for users. Check out our posts for more examples of Discord scams: Malicious activity in Discord chats Cryptoscam in Discord Discord cryptoscam: Attack of the clones Discord cryptoscam: Revenge of the fraudsters Discord cryptoscam: A new hope

 Feed

Threat hunters have disclosed two different malware campaigns that have targeted vulnerabilities and misconfigurations across cloud environments to deliver cryptocurrency miners. The threat activity clusters have been codenamed Soco404 and Koske by cloud security firms Wiz and Aqua, respectively. Soco404 "targets both Linux and Windows systems, deploying platform-specific malware," Wiz

 Feed

A recent analysis of enterprise data suggests that generative AI tools developed in China are being used extensively by employees in the US and UK, often without oversight or approval from security teams. The study, conducted by Harmonic Security, also identifies hundreds of instances in which sensitive data was uploaded to platforms hosted in China, raising concerns over compliance, data

 Feed

The U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) sanctioned a North Korean front company and three associated individuals for their involvement in the fraudulent remote information technology (IT) worker scheme designed to generate illicit revenues for Pyongyang. The sanctions target Korea Sobaeksu Trading Company (aka Sobaeksu United Corporation), and Kim Se Un, Jo

 Feed

The threat actor known as Patchwork has been attributed to a new spear-phishing campaign targeting Turkish defense contractors with the goal of gathering strategic intelligence. "The campaign employs a five-stage execution chain delivered via malicious LNK files disguised as conference invitations sent to targets interested in learning more about unmanned vehicle systems," Arctic Wolf Labs said

 Feed

Russian aerospace and defense industries have become the target of a cyber espionage campaign that delivers a backdoor called EAGLET to facilitate data exfiltration. The activity, dubbed Operation CargoTalon, has been assigned to a threat cluster tracked as UNG0901 (short for Unknown Group 901). "The campaign is aimed at targeting employees of Voronezh Aircraft Production Association (VASO), one

 Breaking News

Source: securityaffairs.com – Author: Pierluigi Paganini New Coyote malware uses Windows UI Automation to steal banking credentials, targeting Brazilian users across 75 banks and crypto platforms. Coyote malware is now the first to exploit Microsoft’s UI Automation framework in the wild, validating prior   show more ...  

warnings from Akamai researchers in December 2024. The UI Automation (UIA) framework […] La entrada Coyote malware is first-ever malware abusing Windows UI Automation – Source: securityaffairs.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Breaking News

Source: securityaffairs.com – Author: Pierluigi Paganini SonicWall addressed a critical vulnerability, tracked as CVE-2025-40599 (CVSS score of 9.1), in SMA 100 appliances SonicWall addressed a critical vulnerability, tracked as CVE-2025-40599 (CVSS score of 9.1), in SMA 100 appliances. Experts warn customers   show more ...  

to check their installs for Indicators of Compromise (IoCs) associated with Overstep malware attacks. […] La entrada SonicWall fixed critical flaw in SMA 100 devices exploited in Overstep malware attacks – Source: securityaffairs.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 AI

Source: securityaffairs.com – Author: Pierluigi Paganini The DSPM market hit around $1.2 billion in 2024 and should grow to $4.5 billion by 2033 (≈16.5% CAGR). The AI sector is projected to swell from $189 billion in 2023 to $4.8 trillion by 2033. The tech realm is continually evolving. New   show more ...  

tools are invented every day, and certain technologies are reaching market valuations that have never […] La entrada DSPM & AI Are Booming: $17.87B and $4.8T Markets by 2033 – Source: securityaffairs.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Breaking News

Source: securityaffairs.com – Author: Pierluigi Paganini A new stealth backdoor has been discovered in the WordPress mu-plugins folder, granting attackers persistent access and control over compromised sites. Sucuri researchers found a stealthy backdoor hidden in WordPress’s “mu-plugins” folder. These   show more ...  

plugins auto-run and allow attackers to stay hidden in admin, and maintain persistence. “must-use plugins” are […] La entrada Stealth backdoor found in WordPress mu-Plugins folder – Source: securityaffairs.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Breaking News

Source: securityaffairs.com – Author: Pierluigi Paganini U.S. CISA adds CrushFTP, Google Chromium, and SysAid flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CrushFTP, Google Chromium, and SysAid flaws to its Known Exploited   show more ...  

Vulnerabilities (KEV) catalog. Below are the descriptions for these flaws: CVE-2025-54309 CrushFTP Unprotected Alternate Channel Vulnerability CVE-2025-6558 Google […] La entrada U.S. CISA adds CrushFTP, Google Chromium, and SysAid flaws to its Known Exploited Vulnerabilities catalog – Source: securityaffairs.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Breaking News

Source: securityaffairs.com – Author: Pierluigi Paganini U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds two Microsoft SharePoint flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two Microsoft SharePoint flaws to its   show more ...  

Known Exploited Vulnerabilities (KEV) catalog. Below are the descriptions for these flaws: CVE-2025-49704 Microsoft SharePoint Code Injection Vulnerability […] La entrada U.S. CISA urges FCEB agencies to fix two Microsoft SharePoint flaws immediately and added them to its Known Exploited Vulnerabilities catalog – Source: securityaffairs.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Critical

Source: thehackernews.com – Author: . Mitel has released security updates to address a critical security flaw in MiVoice MX-ONE that could allow an attacker to bypass authentication protections. “An authentication bypass vulnerability has been identified in the Provisioning Manager component of Mitel   show more ...  

MiVoice MX-ONE, which, if successfully exploited, could allow an unauthenticated attacker to conduct […] La entrada Critical Mitel Flaw Lets Hackers Bypass Login, Gain Full Access to MiVoice MX-ONE Systems – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . Virtualization and networking infrastructure have been targeted by a threat actor codenamed Fire Ant as part of a prolonged cyber espionage campaign. The activity, observed this year, is primarily designed Now to infiltrate organizations’ VMware ESXi and vCenter   show more ...  

environments as well as network appliances, Sygnia said in a new report […] La entrada Fire Ant Exploits VMware Flaws to Compromise ESXi Hosts and vCenter Environments – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CastleLoader

Source: thehackernews.com – Author: . Cybersecurity researchers have shed light on a new versatile malware loader called CastleLoader that has been put to use in campaigns distributing various information stealers and remote access trojans (RATs). The activity employs Cloudflare-themed ClickFix phishing attacks   show more ...  

and fake GitHub repositories opened under the names of legitimate applications, Swiss cybersecurity […] La entrada CastleLoader Malware Infects 469 Devices Using Fake GitHub Repos and ClickFix Phishing – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . Sophos and SonicWall have alerted users of critical security flaws in Sophos Firewall and Secure Mobile Access (SMA) 100 Series appliances that could be exploited to achieve remote code execution.  The two vulnerabilities impacting Sophos Firewall are listed below –   show more ...  

CVE-2025-6704 (CVSS score: 9.8) – An arbitrary file writing vulnerability […] La entrada Sophos and SonicWall Patch Critical RCE Flaws Affecting Firewalls and SMA 100 Devices – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0CISO2CISO

Source: www.securityweek.com – Author: Ionut Arghire An Arizona woman was sentenced to prison for her role in a North Korean fake IT worker scheme that hit more than 300 companies and generated over $17 million in illicit revenue. The woman, Christina Marie Chapman, 50, of Litchfield Park, was charged in May   show more ...  

last year with running […] La entrada US Targets North Korea’s Illicit Funds: $15M Rewards Offered as American Woman Jailed in IT Worker Scam – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 A Little Sunshine

Source: krebsonsecurity.com – Author: BrianKrebs KrebsOnSecurity recently heard from a reader whose boss’s email account got phished and was used to trick one of the company’s customers into sending a large payment to scammers. An investigation into the attacker’s infrastructure points to a long-running   show more ...  

Nigerian cybercrime ring that is actively targeting established companies in the […] La entrada Phishers Target Aviation Execs to Scam Customers – Source: krebsonsecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: news.sophos.com – Author: Editor PRODUCTS & SERVICES Sophos has been recognized for defending customers of all sizes against today’s complex cyberattacks, achieving four prestigious awards at the SE Labs Awards 2025. We’re thrilled to announce that Sophos won four awards in this year’s SE   show more ...  

LABS ® Awards 2025. The accolades – presented July 2nd […] La entrada Sophos captures multiple honors at SE Labs Awards 2025 – Source: news.sophos.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.schneier.com – Author: Bruce Schneier The current state of digital identity is a mess. Your personal information is scattered across hundreds of locations: social media companies, IoT companies, government agencies, websites you have accounts on, and data brokers you’ve never heard of. These   show more ...  

entities collect, store, and trade your data, often without your knowledge […] La entrada How Solid Protocol Restores Digital Agency – Source: www.schneier.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Clorox

Source: securityboulevard.com – Author: Jeffrey Burt Clorox is suing Cognizant for $380 million, saying the IT services provider’s service desk put in place to protect the multinational company from cyber risks in 2023 gave hackers password resets and other credentials when asked without verifying the   show more ...  

identities of people making the requests. The post Cognizant Agents […] La entrada Cognizant Agents Gave Hackers Passwords, Clorox Says in Lawsuit – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securityboulevard.com – Author: Alan Shimel Vibe coding is here. And it’s not just a fad — it’s reshaping how we build, deploy and even conceive of software. But unless we hit the brakes and bake in security now, we’re setting ourselves up for another generation of vulnerabilities, exploits and   show more ...  

blame games. The post The […] La entrada The “S” in Vibe Coding Stands for Security – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Jessica Lyons An Arizona woman who ran a laptop farm from her home – helping North Korean IT operatives pose as US-based remote workers – has been sentenced to eight and a half years behind bars for her role in a $17 million fraud that hit more than 300 American   show more ...  

companies. […] La entrada Laptop farmer behind $17M North Korean IT worker scam locked up for 8.5 years – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Iain Thomson The AMEOS Group, which runs over 100 hospitals across Europe, has shut down its entire network after crims busted in. The organization, which is Swiss-owned but runs medical treatment facilities across the continent, said that unknown miscreants have penetrated   show more ...  

its IT systems and may have accessed patient health records, […] La entrada Euro healthcare giant AMEOS Group shuts down IT systems after mystery attack – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Carly Page Threat actors have actively exploited a newly patched vulnerability in Cisco’s Identity Services Engine (ISE) software since early July, weeks before the networking giant got around to issuing a fix. That’s according to the Shadowserver Foundation, a   show more ...  

nonprofit organization that scans and monitors the internet for exploitation. The company’s […] La entrada No login? No problem: Cisco ISE flaw gave root access before fix arrived, say researchers – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Thomas Claburn Computer scientists with the University of Waterloo in Ontario, Canada, say they’ve developed a way to remove watermarks embedded in AI-generated images. To support that claim, they’ve released a software tool called UnMarker. It can run offline,   show more ...  

and can remove an image watermark in only a few minutes using […] La entrada So much for watermarks: UnMarker tool nukes AI provenance tags – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . Threat hunters have disclosed two different malware campaigns that have targeted vulnerabilities and misconfigurations across cloud environments to deliver cryptocurrency miners. The threat activity clusters have been codenamed Soco404 and Koske by cloud security firms Wiz   show more ...  

and Aqua, respectively. Soco404 “targets both Linux and Windows systems, deploying platform-specific malware,” Wiz […] La entrada Soco404 and Koske Malware Target Cloud Services with Cross-Platform Cryptomining Attacks – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . A recent analysis of enterprise data suggests that generative AI tools developed in China are being used extensively by employees in the US and UK, often without oversight or approval from security teams. The study, conducted by Harmonic Security, also identifies hundreds   show more ...  

of instances in which sensitive data was uploaded […] La entrada Overcoming Risks from Chinese GenAI Tool Usage – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CSO and CISO

Source: www.csoonline.com – Author: Cybersecurity leaders reveal the books that have influenced how they lead, think, and manage security in the enterprise — and their own lives. From strategy and psychology to history and decision-making, these are the books CISOs recommend to sharpen your thinking,   show more ...  

influence your leadership style, and help navigate the complexity of […] La entrada The books shaping today’s cybersecurity leaders – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CSOonline

Source: www.csoonline.com – Author: News Jul 24, 20255 mins MalwareOpen SourceSupply Chain Phishing attacks on package maintainer accounts led to infected JavaScript type testing utilities. In a newly discovered supply chain attack, attackers last week targeted a range of npm-hosted JavaScript type testing   show more ...  

utilities, several of which were successfully compromised to distribute malware. Anyone automatically […] La entrada Supply chain attack compromises npm packages to spread backdoor malware – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CSOonline

Source: www.csoonline.com – Author: A July 8 fix for a critical SharePoint zero-day failed to stop active exploitation, enabling state-backed attackers to breach nearly 100 organizations worldwide. A July 8 patch for the SharePoint Server zero-day flaw, which resulted in a global attack on nearly 100   show more ...  

organizations over the weekend starting July 18, had failed […] La entrada Microsoft’s incomplete SharePoint patch led to global exploits by China-linked hackers – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Artificial Intelligence

Source: www.csoonline.com – Author: The incident highlights rising AI risks as malicious actors exploit powerful tools amid weak safeguards and oversight. A hacker managed to insert destructive system commands into Amazon’s Visual Studio Code extension used for accessing its AI-powered coding assistant, Q,   show more ...  

which was later distributed to users through an official update, according to […] La entrada Hacker inserts destructive code in Amazon Q tool as update goes live – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Tara Seals Please enable cookies. Sorry, you have been blocked You are unable to access darkreading.com Why have I been blocked? This website is using a security service to protect itself from online attacks. The action you just performed triggered the security solution.   show more ...  

There are several actions that could trigger this […] La entrada North Korea’s IT Worker Rampage Continues Amid DoJ Action – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Swati Babbar Please enable cookies. Sorry, you have been blocked You are unable to access darkreading.com Why have I been blocked? This website is using a security service to protect itself from online attacks. The action you just performed triggered the security solution.   show more ...  

There are several actions that could trigger this […] La entrada Why Security Nudges Took Off – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Robert Lemos, Contributing Writer Please enable cookies. Sorry, you have been blocked You are unable to access darkreading.com Why have I been blocked? This website is using a security service to protect itself from online attacks. The action you just performed triggered   show more ...  

the security solution. There are several actions that could […] La entrada The Young and the Restless: Young Cybercriminals Raise Concerns – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Rob Wright Please enable cookies. Sorry, you have been blocked You are unable to access darkreading.com Why have I been blocked? This website is using a security service to protect itself from online attacks. The action you just performed triggered the security solution.   show more ...  

There are several actions that could trigger this […] La entrada Can Security Culture Be Taught? AWS Says Yes – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Blog

Source: socprime.com – Author: Daryna Olyniychuk Following closely after the Interlock ransomware attacks that used a new custom RAT delivered through a modified ClickFix variant called FileFix, a new malicious campaign has emerged, also leveraging a ClickFix-themed malware delivery website. Defenders have   show more ...  

uncovered a novel global Epsilon Red ransomware operation that began in July 2025, […] La entrada Epsilon Red Ransomware Detection: New Adversary Campaign Targeting Users Globally via ClickFix – Source: socprime.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 BlackSuit

Source: www.infosecurity-magazine.com – Author: BlackSuit’s dark web data leak site and private negotiation panels have been taken offline in what appears to be a large-scale law enforcement operation. On July 24, the ransomware group’s leading site, usually accessible via The Onion Router (TOR), displayed   show more ...  

a banner stating, “This site has been seized by U.S. Homeland […] La entrada BlackSuit Ransomware Group’s Dark Web Sites Seized in Operation Checkmate – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: A prolonged Chinese cyber espionage campaign is targeting VMware appliances to gain access to target networks, according to Sygnia researchers. The campaign has been tracked since early 2025. The attackers, dubbed Fire Ant, have been observed using combinations of   show more ...  

sophisticated and stealthy techniques to create multilayered attack kill chains, which facilitate […] La entrada Prolonged Chinese Cyber Espionage Campaign Targets VMware Appliances – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

2025-07
Aggregator history
Friday, July 25
TUE
WED
THU
FRI
SAT
SUN
MON
JulyAugustSeptember