Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Only 24% of Cybersec ...

 Cyber News

In a major step toward bridging the gender gap in technology, UN Women and the Global Cybersecurity Forum (GCF) have signed a Memorandum of Understanding (MoU) to strengthen women’s participation and leadership in cybersecurity and the digital economy. The agreement was formalized during the GCF Annual Meeting in   show more ...  

Riyadh, Saudi Arabia, marking a significant milestone for global gender equality efforts in the digital era. The partnership builds on UN Women’s commitment to advancing the Beijing+30 Action Agenda, which emphasizes women’s empowerment and equal access to opportunities across all sectors, including science and technology. The MoU reflects a shared vision between UN Women and GCF—to ensure that women and girls benefit equally from the digital revolution shaping economies and societies today. UN Women and GCF Driving Equal Representation in Cybersecurity Under the new agreement, both organizations will collaborate to increase women’s representation in cybersecurity through strategic partnerships, advocacy, and capacity-building initiatives. The partnership will promote cross-learning events, joint high-level convenings, and digital advocacy campaigns under GCF’s Women Empowerment in Cybersecurity initiative and UN Women’s global innovation and technology programs. The collaboration comes at a time when the cybersecurity sector is facing a widening talent gap. According to GCF’s 2024 Cybersecurity Workforce Report, women currently represent only 24 percent of the global cybersecurity workforce, despite growing demand for professionals in the field. The report, developed in collaboration with the Boston Consulting Group (BCG), highlights a serious shortfall in cybersecurity talent, with only 72 percent of roles currently filled worldwide. This shortfall poses a pressing challenge for governments and organizations striving to build a future-ready cybersecurity workforce. The report emphasizes that enhancing gender diversity is not only a matter of equality but also a strategic necessity for strengthening cybersecurity capabilities. Diverse teams bring broader perspectives, creativity, and problem-solving approaches—essential traits for staying ahead of increasingly complex cyber threats. Addressing the Skills Gap in Cybersecurity Workforce The GCF–BCG report outlines several strategic recommendations for addressing the skills shortage, including the need to attract new talent and foster an environment that supports women’s career advancement in cybersecurity. Encouraging girls and women to pursue studies in STEM, providing mentorship opportunities, and establishing clear career pathways are seen as key steps toward achieving this goal. The collaboration between UN Women and GCF aims to translate these recommendations into action by leveraging both organizations’ networks and expertise. Through targeted digital amplification and global partnerships, the initiative will highlight women leaders, promote visibility for women professionals, and support organizations in adopting inclusive hiring and retention practices. The Broader Economic Impact Beyond workforce development, the partnership aligns with the findings of UN Women’s recently released “Gender Snapshot 2025” report. The study underscores that closing the gender digital divide could have a transformative impact on global development. According to the report, enabling digital access and opportunities for women could benefit 343.5 million women and girls worldwide, lift 30 million out of poverty by 2050, and generate an estimated USD 1.5 trillion boost to global GDP by 2030. However, the report also warns that progress remains fragile. If current trends continue, by 2030, 351 million women and girls could still be living in extreme poverty, and the world risks missing the Sustainable Development Goal (SDG) 5—achieving gender equality and empowering all women and girls. UN Women stresses that this outcome is not inevitable. With strong partnerships, sustained investments, and political will, it is possible to reverse current trends and create a more inclusive digital future. The collaboration with GCF represents a decisive step toward that goal, focusing on practical measures that can help bridge the gender gap in cybersecurity. A Step Toward an Inclusive Digital Future The partnership between UN Women and the Global Cybersecurity Forum comes at a crucial time when the digital economy is reshaping the global workforce. As cyber threats grow more sophisticated, inclusion and diversity are becoming central to resilience and innovation. By combining UN Women’s leadership in gender equality with GCF’s global reach in cybersecurity advocacy, the partnership aims to empower more women to participate, lead, and innovate in one of the world’s fastest-evolving fields. This joint effort not only reinforces the global commitment to equality but also highlights the vital link between gender inclusion and digital security—a connection that could define the future of cybersecurity in the coming decade.

image for New Polymorphic Malw ...

 Cyber News

A new polymorphic malware identified by a security researcher earlier this week remains undetected by most security tools. Xavier Mertens wrote about the malware in a SANS blog post on October 8. At the time, there were only two detections of the malware on VirusTotal. Two days later, there are still only two   show more ...  

detections. Polymorphic Malware Built on Python The malware, a Python remote access trojan (RAT) uploaded to VirusTotal as "nirorat.py," got Mertens’ attention because of some function names in the code: self_modifying_wrapper(), decrypt_and_execute() and polymorph_code(). Polymorphic malware is designed to mutate its appearance or signature files every time it executes, he said. “To be able to modify its code on the fly, the program must have access to its own source code,” he wrote. “Many languages have this capability.” In Python, the inspect module can add that capability, he added. In the malware he identified, Mertens said the self_modifying_wrapper() function “will grab a function code, XOR it with a random key then un-XOR it and execute it from memory” to wrap critical code in a self-modifying layer. The malware also has the capability to obfuscate code with advanced variable renaming and junk code injection. He included code samples for the self_modifying_wrapper() and polymorph_code() functions. Python RAT also Includes More Than 40 Attack Capabilities The malware also has more than 40 attack and reconnaissance capabilities “and offers plenty of features to the Attacker,” he said. Some of the functions and capabilities include network and host scanning, router hacking, testing default credentials, screen recording, payload delivery and execution, stolen data transmission, lateral movement, and more. Among the bot commands are options for deploying the Xworm payload, running a keylogger and exporting the logs, encrypting the victim’s files, running a cryptominer, capturing screenshots and audio, running shell commands, uploading files to the victim PC, and searching and sending files from the PC.

image for ‘Payroll Pirate’ ...

 Cyber News

Microsoft Threat Intelligence has revealed a spate of financially motivated cyberattacks against universities across the United States. The threat actor, known as Storm-2657, is exploiting weak authentication as part of what experts are calling “payroll pirate” attacks, a scheme in which an attacker reroutes an   show more ...  

employee's salary into a bank account controlled by the attacker. According to Microsoft, the group has been accessing the accounts of university employees by stealing their login credentials and multifactor authentication (MFA) codes. Once they accessed the account, they would have access to the human resources (HR) system, such as Workday, and then change the payroll information to redirect payments. The campaign lasted for the first half of 2025 and primarily focused on universities; however, it raises questions for any organization using a cloud HR or payroll platform. Workday was the most common solution attacked, but Microsoft clarified that the attacks exploited human error and weak authentication, not an actual vulnerability in the Workday platform. “These actors are financially motivated and rely on social engineering, not vulnerabilities in Workday,” said Microsoft in its follow-up analysis. “Organizations without phishing-resistant MFA continue to be at risk.” Phishing Campaigns Masquerading as Campus Alerts Microsoft’s investigation revealed that Storm-2657 used highly convincing phishing campaigns to gain initial access. The attackers crafted emails designed to mimic official university communications, tricking recipients into revealing credentials and MFA codes. Since March 2025, Microsoft observed 11 compromised accounts across three universities, which were then used to send phishing emails to nearly 6,000 individuals at 25 other institutions. Some messages contained Google Docs links — a tactic that made detection more difficult in academic environments where such tools are widely used. The phishing emails followed several recurring themes. Early campaigns carried alarming subject lines such as: “COVID-Like Case Reported — Check Your Contact Status” “Confirmed Case of Communicable Illness” “Faculty Compliance Notice – Classroom Misconduct Report” These messages urged recipients to click links under the guise of checking exposure details or reviewing faculty reports. One campaign targeted 500 employees at a single university, yet only 10 percent flagged the message as suspicious. In more recent attacks, Storm-2657 impersonated university officials or HR departments, sending emails about “compensation updates” or “benefits revisions.” Some even mentioned university presidents by name to appear authentic. Once a victim clicked the embedded link, they were directed to a fake login page where attackers harvested credentials and MFA tokens. Hijacking Workday Accounts and Hiding the Evidence After obtaining access, the attackers moved swiftly. They logged into victims’ email and Workday accounts using stolen credentials and created inbox rules to automatically delete notifications from Workday. This ensured that employees would not see alerts about changes to their payroll or bank details. Microsoft found that the hackers then modified the “Payment Election” settings within Workday, updating bank account numbers to their own. These changes redirected future salary deposits to fraudulent accounts — a tactic that went unnoticed until paydays arrived. To maintain long-term access, the threat actors also registered their own phone numbers as MFA devices on compromised profiles. This allowed them to bypass future authentication requests and continue accessing systems without alerting victims. “The attackers were deliberate and methodical,” Microsoft explained. “By setting up inbox rules and enrolling new MFA devices, they effectively erased traces of their intrusion.” Payroll Pirates Are Exploiting Trust, Not Technology The “payroll pirate” scheme is a variant of business email compromise (BEC), a tactic that continues to cause major financial damage globally. According to the FBI’s 2024 Internet Crime Report, BEC schemes resulted in over $2 billion in losses last year alone. Unlike traditional ransomware attacks, BEC operations rely on deception and social engineering rather than malware. Criminals manipulate employees into sending money or credentials through emails that look legitimate. Microsoft’s findings highlight how academic institutions, often balancing open communication with limited cybersecurity budgets, are becoming soft targets for such financially driven operations. Microsoft’s Response and Recommendations Microsoft said it has notified several affected universities and shared details of Storm-2657’s tactics, techniques, and procedures to help organizations strengthen their defenses. The company also worked with Workday to issue mitigation guidance for customers. Workday, in a statement, emphasized the importance of enabling strong authentication measures. “We encourage customers to use phishing-resistant MFA and add extra verification steps for sensitive actions like payroll updates,” a Workday spokesperson said. Microsoft recommends that organizations adopt passwordless authentication methods such as FIDO2 security keys, Windows Hello for Business, or Microsoft Authenticator passkeys. These measures can significantly reduce the risk of credential theft. Security teams are also urged to monitor for unusual changes in payroll or inbox rules, particularly those involving deletions of messages from HR systems. If any suspicious activity is detected, affected accounts should have credentials reset immediately, unauthorized MFA devices removed, and payroll configurations restored.

image for Fenrir PoC Breaks Se ...

 Cyber News

A newly released proof-of-concept (PoC) exploit has disclosed a severe code-execution vulnerability affecting the Nothing Phone (2a) and the CMF Phone 1, both of which are powered by MediaTek chipsets. The exploit, named “fenrir”, compromises the secure boot process, allowing attackers to execute arbitrary code at   show more ...  

EL3, the most privileged level in the ARM architecture.  Flaw in Nothing Phone (2a) and the CMF Phone 1  The issue lies in a logic flaw in how MediaTek devices handle secure boot verification when the bootloader is unlocked. Specifically, the Preloader fails to verify the bl2_ext partition if the seccfg (security configuration) state is set to unlocked. Since bl2_ext is responsible for verifying all subsequent stages of the boot chain, this oversight allows an attacker to load untrusted code with full privileges.  The PoC operates by patching the function sec_get_vfy_policy() in the bl2_ext binary to always return zero. This forces the device to skip verification checks and load any boot image without authentication.  Key technical features of the PoC include:  Written in Python, C, and shell scripts.  Automates patching and flashing processes.  Spoofs the device’s lock state, tricking integrity checks into passing.  Registers custom fastboot commands and can dynamically call bootloader functions.  Build process:  Place the original bootloader image in bin/[device].bin.  Run ./build.sh pacman (or provide a custom path).  The script generates a patched image: lk.patched.  Flashing process:  Use ./flash.sh to flash the patched image via fastboot.  If fastboot is unavailable, alternative flashing tools may be required.  Confirmed Devices and Broader Implications  The exploit has been successfully tested on the Nothing Phone (2a) (codename: pacman) and is known to function on the CMF Phone 1 (tetris), though full support for the latter is still under development. Other MediaTek-powered devices are likely at risk.  One notable example is the Vivo X80 Pro, which, according to the author, doesn’t verify bl2_ext even with a locked bootloader, worsening the security risk.  Once exploited, the device's entire chain of trust is compromised. Potential outcomes include:  Installation of unauthorized operating systems.  Firmware manipulation without detection.  Circumvention of security features that rely on boot-time integrity.  Warnings and Disclaimers from the Author  The PoC author provides strong warnings:  "I AM NOT RESPONSIBLE FOR BRICKED DEVICES. This exploit can permanently destroy your phone if something goes wrong."  The project is licensed under the GNU Affero General Public License v3.0 (AGPL-3.0), which requires source code disclosure for any public or networked use of the modified software.  Recommendations for Users and Vendors Until official patches are released:  Users should avoid unlocking bootloaders.  Device makers and MediaTek must enforce verification of bl2_ext even in unlocked states.  Security teams should investigate whether other devices are affected by checking the img_auth_required flag in expdb dumps.  The PoC is actively maintained and includes a roadmap:  Add full support for more devices.  Resolve MMU faults during runtime memory modification.  Develop a stable method for payload appending.  At present, the payload component is experimental. While it cannot yet modify memory at runtime, it supports boot mode control, custom commands, and dynamic function calls within the bootloader. 

image for Italy Claims Victory ...

 Firewall Daily

The 11th edition of the European Cybersecurity Challenge (ECSC) was held from October 6 to 9, 2025, in Warsaw, Poland, with Italy proudly taking the top spot. This event, which brings together the most talented young cybersecurity professionals from across Europe, saw Italy coming in first place, followed by Denmark   show more ...  

in second place and Germany securing third. Hosted by Poland’s National Research Institute, NASK, and supported by the EU Agency for Cybersecurity (ENISA), the ECSC 2025 welcomed 39 teams representing EU Member States, European Free Trade Association (EFTA) countries, EU candidate countries, and international guest teams. Several additional delegations also attended as observers, signaling future participation intentions. Leadership Voices Highlight the Importance of Cybersecurity The event was officially opened by Krzysztof Gawkowski, Deputy Prime Minister of Poland and Minister of Digital Affairs, alongside Radosław Nielek, Director of NASK. Gawkowski emphasized the growing importance of cybersecurity in the modern era, stating, “Cybersecurity is now a pillar of state and citizen safety. These competitions are, of course, a game, but one of great importance – because we live in a time of hybrid warfare, in which cyberattacks are just as dangerous as those carried out in the real world.” He praised Polish cybersecurity teams for consistently demonstrating world-class talent throughout the competition’s history. Radosław Nielek highlighted the intensity of the contest, remarking, “I watched the results change every minute, with one team or another taking the lead. This shows how close the competition was and that the absolute best were fighting it out here.” Nielek also emphasized the collaborative spirit behind the ECSC, noting that the event goes beyond rivalry by building connections and partnerships that will help shape the future of European cybersecurity. Juhan Lepassaar, Executive Director of ENISA, described the ECSC as a vital platform that tests not only participants’ technical skills but also their critical thinking, creativity, and teamwork under pressure. “The European Cybersecurity Challenge, therefore, remains a comprehensive learning tool to develop the workforce needed in Europe and anticipate the demands for cybersecurity expertise jobs,” Lepassaar explained. Similarly, Luca Tagliaretti, Executive Director of the European Cybersecurity Competence Centre, stressed the ECSC’s role in fostering shared values and cooperation. He stated, “The Challenge promotes shared values: trust, responsibility, the spirit of cooperation in diversity, the very same principles needed to strengthen and secure Europe’s digital future.” He added that the competition is an important stepping stone for the next generation of cybersecurity experts to connect, learn, and build lasting relationships. Intense Challenges and Teamwork Define the Competition The competition itself spanned two days and included a variety of Capture the Flag (CTF) challenges. Day one followed a Jeopardy-style format, while day two featured an Attack/Defense scenario. Contestants faced challenges in hardware security, web and mobile security, cryptography, reverse engineering, binary exploitation, and digital forensics. Success required more than just technical knowledge; quick decision-making and teamwork under dynamic conditions were crucial. Awards were presented during the closing ceremony by NASK Director Radosław Nielek, Deputy Prime Minister Krzysztof Gawkowski, ENISA’s Head of Capacity Building Evangelos Ouzounis, and Josef Pichlmayr from the ECSC executive committee. Italy was recognized as the champion, Denmark as runner-up, and Germany took third place. The Female+ Bootcamp Initiative Following the main event, a Female+ Bootcamp was held at NASK’s premises on October 10 and 11. This initiative aimed to promote diversity in cybersecurity by providing female participants from national teams with technical training, mentoring, and networking opportunities. The bootcamp’s goal is to build confidence and skill among women in cybersecurity, culminating in the formation of a Female Team Europe. This team is set to represent Europe at an international female cybersecurity competition scheduled for 2026 in Dublin, Ireland.

image for BreachForums Seized ...

 Business News

The latest incarnation of the BreachForums cybercrime forum has been seized by U.S. and French law enforcement. The seizure of the BreachForums[.]hn data leak site by the FBI, Department of Justice and French counterparts came just ahead of an October 10 deadline set by the Scattered LAPSUS$ Hunters threat group for   show more ...  

victims of its Salesforce and Salesloft data breaches to pay ransom or face public data leaks. The FBI placed a seizure notice on the site on October 9, and the seizure was also confirmed by Scattered LAPSUS$ Hunters in a PGP-signed message on the group’s Telegram channel. [caption id="attachment_105899" align="aligncenter" width="1634"] BreachForums seizure notice[/caption] The threat group’s Tor data leak site remains operational – as does the group’s threat to release data beginning at 11:59 PM EST tonight. “BreachForums was seized by the FBI and international partners today,” the threat group’s message said. “This was inevitable and I am not surprised. Neither I and others involved with this group have been arrested. All our BreachForums domains were taken from us by the US Government a few days ago. The era of forums are over.” BreachForums Seizure Spotted Days Before Official Notice The BreachForums seizure was apparently spotted days before by a Telegram poster who goes by the name “emo,” who noted that the site shared Cloudflare name servers with other FBI-seized sites. Scattered LAPSUS$ Hunters also seemed to know that the site was breached because the group apparently took down the site, noting in an October 7 post that “We do not operate a clearnet domain anymore, it will be on the onion.” In a statement to The Cyber Express today, a Scattered LAPSUS$ Hunters spokesperson said, "We were well aware that our domains were snatched. During that time we did not know by who, but when the NS were changed to Cloudflare, we immediately knew who it was. Our BreachForums TOR onion hidden service was also seized because all of our BreachForums backend servers/infrastructure were also seized and destroyed." The threat group said in its PGP-signed message that it “conducted a thorough incident response on the BreachForums infrastructure ever since the domains were taken.” The group noted that the latest BreachForums database backup “was compromised along with every single database backup since 2023 till now,” all escrow databases were compromised, and backend servers were "seized and destroyed.” “For your own safety, security, and sanity keep your opsec in check,” the group said in its message. “I have no doubt the FBI and other international partners involved will be cracking down on many individuals in the next coming few weeks to months.” The message noted that it was the fourth time the forums had been seized, going back to BreachForums predecessor RaidForums, and the forums' history has also included some dramatic arrests. “BreachForums is never coming back, if it comes back, it should immediately be considered a honeypot,” the message said. The message also included some background on the history of BreachForums: “The following is not common knowledge among the general community and public but when RaidForums was seized and BreachForums was launched shortly after, pompompurin was just a front. We all carefully planned the launch of BreachForums since day 1.” Scattered LAPSUS$ Hunters Maintains Salesforce Threat The threat group’s message concluded by noting that the October 10 Salesforce leak deadline remains intact. “[O]ne thing to note is, the recent action the US Government has took against us, has no impact on our Salesforce campaigns. The fact that our DLS [data leak site] was also hosted on BreachForums clearnet domain and because we planned to re-open the forum to leak the data of companies who have not complied with us when the deadline arrived onto the re-opened BreachForums was likely the cause of todays seizure.”  

image for Senators Peters and ...

 Cyber News

In a renewed push to safeguard America’s digital infrastructure, U.S. Senators Gary Peters (D-MI) and Mike Rounds (R-SD) have introduced the Protecting America from Cyber Threats Act — a bipartisan bill aimed at restoring critical cybersecurity protections that expired on September 30. The bipartisan bill would   show more ...  

reauthorize key provisions of the Cybersecurity Information Sharing Act of 2015, which has been instrumental in allowing private companies to voluntarily share cybersecurity threat indicators, such as malware signatures, software vulnerabilities, and malicious IP addresses, with the Department of Homeland Security (DHS). This framework, which had been active for a decade, is credited with helping prevent data breaches, protecting personal and corporate information, and improving the federal government’s ability to detect and respond to attacks from foreign adversaries and cybercriminal networks. Renewing Bipartisan Bill “This bipartisan bill renews a proven framework that has helped defend critical networks at our hospitals, financial systems, and energy grids from cyberattacks for a decade,” said Senator Peters, Ranking Member of the Homeland Security and Governmental Affairs Committee. “We must quickly renew these longstanding cybersecurity protections that encourage companies to voluntarily share information about cybersecurity threats with the federal government to ensure we are prepared to defend our national and economic security against relentless attacks.” Senator Rounds echoed this sentiment, emphasizing the urgency of the reauthorization of bipartisan bill. “The Cybersecurity Information Sharing Act of 2015 has been instrumental in strengthening our nation’s cyber defenses by enabling critical information sharing between the private sector and government. The lapse in this legislation due to the government shutdown leaves our nation vulnerable to cyberattacks. Our legislation would extend these provisions for an additional 10 years.” Addressing the Gaps and Liability Concerns The newly proposed Protecting America from Cyber Threats Act not only seeks to renew the expired cybersecurity protections but also introduces a retroactive clause. This bipartisan bill ensures that companies that continued sharing cyber threat data with the government during the lapse period remain protected from liability. “We have to continue to get real-time information on threats in order to stand up against persistent cybersecurity attacks,” Peters told reporters during a recent briefing. “We want folks to know that when this bill passes, anything that happened during that gap will also be protected from potential liability.” This assurance comes as several industries have expressed concern over the legal uncertainty following the lapse of the 2015 law. Many companies that regularly share cyber threat indicators with the federal government have reportedly been hesitant to continue without guaranteed protections. Building on a Decade of Cyber Defense The bipartisan bill builds upon the foundation of the 2015 law, which facilitated information sharing that helped address major cyber incidents, including SolarWinds, Volt Typhoon, and Salt Typhoon. These attacks exposed vulnerabilities across both government systems and private networks, highlighting the need for continued collaboration. The proposed legislation also reaffirms privacy protections by ensuring that personally identifiable information (PII) is excluded from threat reports. This balance between information sharing and privacy has been a cornerstone of the program’s success. When private companies report security flaws or ongoing cyberattacks, it allows the federal government to act quickly, preventing threats from spreading and helping affected organizations recover faster. The shared intelligence is also disseminated to state and local governments and critical infrastructure operators, ensuring communities across the nation are equipped with the latest threat information. Bipartisan Bill: Strong Industry Support The bipartisan bill effort has garnered widespread support from major industry groups, including Airlines for America, the American Gas Association, the Bank Policy Institute, the Business Roundtable, the Chamber of Commerce, the Edison Electric Institute, the National Association of Manufacturers, and the National Retail Federation. These organizations have long advocated for a stable and predictable framework for cyber threat sharing, emphasizing that short-term renewals are not sufficient to manage the nation’s complex cybersecurity challenges. “One thing that is very clear from all stakeholders is that they need long-term certainty when it comes to these protections,” Peters noted. “You can’t operate with just a few-week patch. That’s no way to run a business or a sophisticated cybersecurity operation.” Legislative Hurdles Ahead Despite broad bipartisan backing, the bipartisan bill faces procedural obstacles in the Senate. Efforts to pass a simple reauthorization earlier were repeatedly blocked by Homeland Security Committee Chairman Rand Paul (R-KY), who has called for additional free speech protections to be included in any longer-term reauthorization. Peters acknowledged the hurdles but remains optimistic. “There are a number of procedures this bill must go through before a vote,” he said, adding that he has discussed the measure with Senate leadership but did not specify a timeline. Senator Peters has been a consistent advocate for strengthening the nation’s cyber defenses. His previous bipartisan efforts have led to laws enhancing cybersecurity for K-12 schools, state and local governments, and federal supply chains.

image for Security risks of vi ...

 Business

Although the benefits of AI assistants in the workplace remain debatable, where they’re being adopted most confidently of all is in software development. Here, LLMs play many roles — from refactoring and documentation, to building whole applications. However, traditional information security problems in   show more ...  

development are now compounded by the unique vulnerabilities of AI models. At this intersection, new bugs and issues emerge almost weekly. Vulnerable AI-generated code When an LLM generates code, it may include bugs or security flaws. After all, these models are trained on publicly available data from the internet — including thousands of examples of low-quality code. A recent Veracode study found that leading AI models now produce code that compiles successfully 90% of the time. Less than two years ago, this figure was less than 20%. However, the security of that code has not improved — 45% still contains classic vulnerabilities from the OWASP Top-10 list, with little change in the last two years. The study covered over a hundred popular LLMs and code fragments in Java, Python, C#, and JavaScript. Thus, regardless of whether the LLM is used for “code completion” in Windsurf or “vibe coding” in Loveable, the final application must undergo thorough vulnerability testing. But in practice this rarely happens: according to a Wiz study, 20% of vibe-coded apps have serious vulnerabilities or configuration errors. As an example of such flaws, the case of the women-only dating app, Tea, is often used, which became notorious after two major data leaks. However, this app predates vibe coding. Whether AI was to blame for Tea’s slip-up will be determined in court. In the case of the startup Enrichlead, though, AI was definitely the culprit. Its founder boasted on social media that 100% of his platform’s code was written by Cursor AI, with “zero hand-written code”. Just days after its launch, it was found to be full of newbie-level  security flaws — allowing anyone to access paid features or alter data. The project was shut down after the founder failed to bring the code up to an acceptable security standard using Cursor. However, he remains undeterred and has since started new vibe-coding-based projects. Common vulnerabilities in AI-generated code Although AI-assisted programming has only existed for a year or two, there’s already enough data to identify its most common mistakes. Typically, these are: Lack of input validation, no sanitization of user input from extraneous characters, and other basic errors leading to classic vulnerabilities such as cross-site scripting (XSS) and SQL injection. API keys and other secrets hardcoded directly into the webpage, and visible to users in its code. Authentication logic implemented entirely on the client side, directly in the site’s code running in the browser. This logic can be easily modified to bypass any checks. Logging errors — from insufficient filtering when writing to logs, to a complete absence of logs. Overly powerful and dangerous functions — AI models are optimized to output code that solves a task in the shortest way possible. But the shortest way is often insecure. A textbook example is using the eval function for mathematical operations on user input. This opens the door to arbitrary code execution in the generated application. Outdated or non-existent dependencies. AI-generated code often references old versions of libraries, makes outdated or unsafe API calls, or even tries to import fictitious libraries. The latter is particularly dangerous because attackers can create a malicious library with a “plausible” name, and the AI agent will include it in a real project. In a systematic study, the authors scanned AI-generated code for weaknesses included in the MITRE CWE Top 25 list. The most common issues were CWE-94 (code injection), CWE-78 (OS command injection), CWE-190 (integer overflow), CWE-306 (missing authentication), and CWE-434 (unrestricted file upload). A striking example of CWE-94 was the recent compromise of the Nx platform, which we covered previously. Attackers managed to trojanize a popular development tool by stealing a token enabling them to publish new product versions. The token theft exploited a vulnerability introduced by a simple AI-generated code fragment. Dangerous prompts The well-known saying among developers “done exactly according to the spec” also applies when working with an AI assistant. If the prompt for creating a function or application is vague and doesn’t mention security aspects, the likelihood of generating vulnerable code rises sharply. A dedicated study found that even general remarks like “make sure the code follows best practices for secure code” reduced the rate of vulnerabilities by half. The most effective approach, however, is to use detailed, language-specific security guidance referencing MITRE or OWASP error lists. A large collection of such security instructions from Wiz Research is available on GitHub; it’s recommended to add them to AI assistants’ system prompts via files like claude.md, .windsurfrules, or similar. Security degradation during revisions When AI-generated code is repeatedly revised through follow-up prompts, its security deteriorates. A recent study had GPT-4o modify previously written code up to 40 times, while researchers scanned each version for vulnerabilities after every round. After only five iterations, the code contained 37% more critical vulnerabilities than the initial version. The study tested four prompting strategies — three of which each having a different emphasis: (i) performance, (ii) security, and (iii) new functionality; the fourth was written with unclear unclear prompts. When prompts focused on adding new features, 158 vulnerabilities appeared — including 29 critical ones. When the prompt emphasized secure coding, the number dropped significantly — but still included 38 new vulnerabilities, seven of them critical. Interestingly, the “security-focused” prompts resulted in the highest percentage of errors in cryptography-related functions. Ignoring industry context In sectors such as finance, healthcare, and logistics there are technical, organizational, and legal requirements that must be considered during app development. AI assistants are unaware of these constraints. This issue is often called “missing depth”. As a result, storage and processing methods for personal, medical, and financial data mandated by local or industry regulations won’t be reflected in AI-generated code. For example, an assistant might write a mathematically correct function for calculating deposit interest, but ignore rounding rules enforced by regulators. Healthcare data regulations often require detailed logging of every access attempt — something AI won’t automatically implement at the proper level of detail. Application misconfiguration Vulnerabilities are not limited to the vibe code itself. Applications created through vibe coding are often built by inexperienced users, who either don’t configure the runtime environment at all, or configure it according to advice from the same AI. This leads to dangerous misconfigurations: Databases required by the application are created with overly broad external access permissions. This results in leaks like Tea/Sapphos, where the attacker doesn’t even need to use the application to download or delete the entire database. Internal corporate applications are left accessible to the public without authentication. Applications are granted elevated permissions for access to critical databases. Combined with the vulnerabilities of AI-generated code, this simplifies SQL injections and similar attacks. Platform vulnerabilities Most vibe-coding platforms run applications generated from prompts directly on their own servers. This ties developers to the platform — including exposure to its vulnerabilities and dependence on its security practices. For example, in July a vulnerability was discovered in the Base44 platform that allowed unauthenticated attackers to access any private application. Development-stage threats The very presence of an assistant with broad access rights on the developer’s computer creates risks. Here are a few examples: The CurXecute vulnerability (CVE-2025-54135) allowed attackers to order the popular AI development tool, Cursor, to execute arbitrary commands on the developer’s machine. All this needed was an active Model Context Protocol (MCP) server connected to Cursor, which an external party could use for access. This is a typical situation — MCP servers give AI agents access to Slack messages, Jira issues, and so on. Prompt injection can be performed through any of these channels. The EscapeRoute vulnerability (CVE-2025-53109) allowed reading and writing of arbitrary files on the developer’s disk. The flaw existed in Anthropic’s popular MCP server, which lets AI agents write and read files in the system. The server’s access restrictions just didn’t work. A malicious MCP server that let AI agents send and receive email via Postmark simultaneously forwarded all correspondence to a hidden address. We predicted the emergence of such malicious MCP servers back in September. A vulnerability in the Gemini command-line interface allowed arbitrary command execution when a developer simply asked the AI assistant to analyze a new project’s code. The malicious injection was triggered from a readme.md file. Amazon’s Q Developer extension for Visual Studio Code briefly contained instructions to wipe all data from a developer’s computer. An attacker exploited a mistake of Amazon’s developers, and managed to insert this malicious prompt into the assistant’s public code without special privileges. Fortunately, a small coding error prevented it from being executed. A vulnerability in the Claude Code agent (CVE-2025-55284) allowed data to be exfiltrated from a developer’s computer through DNS requests. Prompt injection, which relied on common utilities that run automatically without confirmation, could be embedded in any code analyzed by the agent. The autonomous AI agent Replit deleted the primary databases of a project it was developing because it decided the database required a cleanup. This violated a direct instruction prohibiting modifications (code freeze). Behind this unexpected AI behavior lays a key architectural flaw — at the time, Replit had no separation between test and production databases. A prompt injection placed in a source code comment prompted the Windsurf development environment to automatically store malicious instructions in its long-term memory, allowing it to steal data from the system over months. In the Nx compromise incident, command-line tools for Claude, Gemini, and Q were used to search for passwords and keys that could be stolen from an infected system. How to use AI-generated code safely The risk level from AI-generated code can be significantly, though not completely reduced through a mix of organizational and technical measures: Implement automatic reviewing of AI-generated code as it’s written using optimized SAST tools. Embed security requirements into the system prompts of all AI environments. Have experienced human specialists perform detailed code reviews, supported by specialized AI-powered security analysis tools to increase effectiveness. Train developers to write secure prompts and, more broadly, provide them with in-depth education on the secure use of AI.

image for DDoS Botnet Aisuru B ...

 DDoS-for-Hire

The world’s largest and most disruptive botnet is now drawing a majority of its firepower from compromised Internet-of-Things (IoT) devices hosted on U.S. Internet providers like AT&T, Comcast and Verizon, new evidence suggests. Experts say the heavy concentration of infected devices at U.S. providers is   show more ...  

complicating efforts to limit collateral damage from the botnet’s attacks, which shattered previous records this week with a brief traffic flood that clocked in at nearly 30 trillion bits of data per second. Since its debut more than a year ago, the Aisuru botnet has steadily outcompeted virtually all other IoT-based botnets in the wild, with recent attacks siphoning Internet bandwidth from an estimated 300,000 compromised hosts worldwide. The hacked systems that get subsumed into the botnet are mostly consumer-grade routers, security cameras, digital video recorders and other devices operating with insecure and outdated firmware, and/or factory-default settings. Aisuru’s owners are continuously scanning the Internet for these vulnerable devices and enslaving them for use in distributed denial-of-service (DDoS) attacks that can overwhelm targeted servers with crippling amounts of junk traffic. As Aisuru’s size has mushroomed, so has its punch. In May 2025, KrebsOnSecurity was hit with a near-record 6.35 terabits per second (Tbps) attack from Aisuru, which was then the largest assault that Google’s DDoS protection service Project Shield had ever mitigated. Days later, Aisuru shattered that record with a data blast in excess of 11 Tbps. By late September, Aisuru was publicly flexing DDoS capabilities topping 22 Tbps. Then on October 6, its operators heaved a whopping 29.6 terabits of junk data packets each second at a targeted host. Hardly anyone noticed because it appears to have been a brief test or demonstration of Aisuru’s capabilities: The traffic flood lasted less only a few seconds and was pointed at an Internet server that was specifically designed to measure large-scale DDoS attacks. A measurement of an Oct. 6 DDoS believed to have been launched through multiple botnets operated by the owners of the Aisuru botnet. Image: DDoS Analyzer Community on Telegram. Aisuru’s overlords aren’t just showing off. Their botnet is being blamed for a series of increasingly massive and disruptive attacks. Although recent assaults from Aisuru have targeted mostly ISPs that serve online gaming communities like Minecraft, those digital sieges often result in widespread collateral Internet disruption. For the past several weeks, ISPs hosting some of the Internet’s top gaming destinations have been hit with a relentless volley of gargantuan attacks that experts say are well beyond the DDoS mitigation capabilities of most organizations connected to the Internet today. Steven Ferguson is principal security engineer at Global Secure Layer (GSL), an ISP in Brisbane, Australia. GSL hosts TCPShield, which offers free or low-cost DDoS protection to more than 50,000 Minecraft servers worldwide. Ferguson told KrebsOnSecurity that on October 8, TCPShield was walloped with a blitz from Aisuru that flooded its network with more than 15 terabits of junk data per second. Ferguson said that after the attack subsided, TCPShield was told by its upstream provider OVH that they were no longer welcome as a customer. “This was causing serious congestion on their Miami external ports for several weeks, shown publicly via their weather map,” he said, explaining that TCPShield is now solely protected by GSL. Traces from the recent spate of crippling Aisuru attacks on gaming servers can be still seen at the website blockgametracker.gg, which indexes the uptime and downtime of the top Minecraft hosts. In the following example from a series of data deluges on the evening of September 28, we can see an Aisuru botnet campaign briefly knocked TCPShield offline. An Aisuru botnet attack on TCPShield (AS64199) on Sept. 28  can be seen in the giant downward spike in the middle of this uptime graphic. Image: grafana.blockgametracker.gg. Paging through the same uptime graphs for other network operators listed shows almost all of them suffered brief but repeated outages around the same time. Here is the same uptime tracking for Minecraft servers on the network provider Cosmic (AS30456), and it shows multiple large dips that correspond to game server outages caused by Aisuru. Multiple DDoS attacks from Aisuru can be seen against the Minecraft host Cosmic on Sept. 28. The sharp downward spikes correspond to brief but enormous attacks from Aisuru. Image: grafana.blockgametracker.gg. BOTNETS R US Ferguson said he’s been tracking Aisuru for about three months, and recently he noticed the botnet’s composition shifted heavily toward infected systems at ISPs in the United States. Ferguson shared logs from an attack on October 8 that indexed traffic by the total volume sent through each network provider, and the logs showed that 11 of the top 20 traffic sources were U.S. based ISPs. AT&T customers were by far the biggest U.S. contributors to that attack, followed by botted systems on Charter Communications, Comcast, T-Mobile and Verizon, Ferguson found. He said the volume of data packets per second coming from infected IoT hosts on these ISPs is often so high that it has started to affect the quality of service that ISPs are able to provide to adjacent (non-botted) customers. “The impact extends beyond victim networks,” Ferguson said. “For instance we have seen 500 gigabits of traffic via Comcast’s network alone. This amount of egress leaving their network, especially being so US-East concentrated, will result in congestion towards other services or content trying to be reached while an attack is ongoing.” Roland Dobbins is principal engineer at Netscout. Dobbins said Ferguson is spot on, noting that while most ISPs have effective mitigations in place to handle large incoming DDoS attacks, many are far less prepared to manage the inevitable service degradation caused by large numbers of their customers suddenly using some or all available bandwidth to attack others. “The outbound and cross-bound DDoS attacks can be just as disruptive as the inbound stuff,” Dobbin said. “We’re now in a situation where ISPs are routinely seeing terabit-per-second plus outbound attacks from their networks that can cause operational problems.” “The crying need for effective and universal outbound DDoS attack suppression is something that is really being highlighted by these recent attacks,” Dobbins continued. “A lot of network operators are learning that lesson now, and there’s going to be a period ahead where there’s some scrambling and potential disruption going on.” KrebsOnSecurity sought comment from the ISPs named in Ferguson’s report. Charter Communications pointed to a recent blog post on protecting its network, stating that Charter actively monitors for both inbound and outbound attacks, and that it takes proactive action wherever possible. “In addition to our own extensive network security, we also aim to reduce the risk of customer connected devices contributing to attacks through our Advanced WiFi solution that includes Security Shield, and we make Security Suite available to our Internet customers,” Charter wrote in an emailed response to questions. “With the ever-growing number of devices connecting to networks, we encourage customers to purchase trusted devices with secure development and manufacturing practices, use anti-virus and security tools on their connected devices, and regularly download security patches.” A spokesperson for Comcast responded, “Currently our network is not experiencing impacts and we are able to handle the traffic.” 9 YEARS OF MIRAI Aisuru is built on the bones of malicious code that was leaked in 2016 by the original creators of the Mirai IoT botnet. Like Aisuru, Mirai quickly outcompeted all other DDoS botnets in its heyday, and obliterated previous DDoS attack records with a 620 gigabit-per-second siege that sidelined this website for nearly four days in 2016. The Mirai botmasters likewise used their crime machine to attack mostly Minecraft servers, but with the goal of forcing Minecraft server owners to purchase a DDoS protection service that they controlled. In addition, they rented out slices of the Mirai botnet to paying customers, some of whom used it to mask the sources of other types of cybercrime, such as click fraud. A depiction of the outages caused by the Mirai botnet attacks against the internet infrastructure firm Dyn on October 21, 2016. Source: Downdetector.com. Dobbins said Aisuru’s owners also appear to be renting out their botnet as a distributed proxy network that cybercriminal customers anywhere in the world can use to anonymize their malicious traffic and make it appear to be coming from regular residential users in the U.S. “The people who operate this botnet are also selling (it as) residential proxies,” he said. “And that’s being used to reflect application layer attacks through the proxies on the bots as well.” The Aisuru botnet harkens back to its predecessor Mirai in another intriguing way. One of its owners is using the Telegram handle “9gigsofram,” which corresponds to the nickname used by the co-owner of a Minecraft server protection service called Proxypipe that was heavily targeted in 2016 by the original Mirai botmasters. Robert Coelho co-ran Proxypipe back then along with his business partner Erik “9gigsofram” Buckingham, and has spent the past nine years fine-tuning various DDoS mitigation companies that cater to Minecraft server operators and other gaming enthusiasts. Coelho said he has no idea why one of Aisuru’s botmasters chose Buckingham’s nickname, but added that it might say something about how long this person has been involved in the DDoS-for-hire industry. “The Aisuru attacks on the gaming networks these past seven day have been absolutely huge, and you can see tons of providers going down multiple times a day,” Coelho said. Coelho said the 15 Tbps attack this week against TCPShield was likely only a portion of the total attack volume hurled by Aisuru at the time, because much of it would have been shoved through networks that simply couldn’t process that volume of traffic all at once. Such outsized attacks, he said, are becoming increasingly difficult and expensive to mitigate. “It’s definitely at the point now where you need to be spending at least a million dollars a month just to have the network capacity to be able to deal with these attacks,” he said. RAPID SPREAD Aisuru has long been rumored to use multiple zero-day vulnerabilities in IoT devices to aid its rapid growth over the past year. XLab, the Chinese security company that was the first to profile Aisuru’s rise in 2024, warned last month that one of the Aisuru botmasters had compromised the firmware distribution website for Totolink, a maker of low-cost routers and other networking gear. “Multiple sources indicate the group allegedly compromised a router firmware update server in April and distributed malicious scripts to expand the botnet,” XLab wrote on September 15. “The node count is currently reported to be around 300,000.” A malicious script implanted into a Totolink update server in April 2025. Image: XLab. Aisuru’s operators received an unexpected boost to their crime machine in August when the U.S. Department Justice charged the alleged proprietor of Rapper Bot, a DDoS-for-hire botnet that competed directly with Aisuru for control over the global pool of vulnerable IoT systems. Once Rapper Bot was dismantled, Aisuru’s curators moved quickly to commandeer vulnerable IoT devices that were suddenly set adrift by the government’s takedown, Dobbins said. “Folks were arrested and Rapper Bot control servers were seized and that’s great, but unfortunately the botnet’s attack assets were then pieced out by the remaining botnets,” he said. “The problem is, even if those infected IoT devices are rebooted and cleaned up, they will still get re-compromised by something else generally within minutes of being plugged back in.” A screenshot shared by XLabs showing the Aisuru botmasters recently celebrating a record-breaking 7.7 Tbps DDoS. The user at the top has adopted the name “Ethan J. Foltz” in a mocking tribute to the alleged Rapper Bot operator who was arrested and charged in August 2025. BOTMASTERS AT LARGE XLab’s September blog post cited multiple unnamed sources saying Aisuru is operated by three cybercriminals: “Snow,” who’s responsible for botnet development; “Tom,” tasked with finding new vulnerabilities; and “Forky,” responsible for botnet sales. KrebsOnSecurity interviewed Forky in our May 2025 story about the record 6.3 Tbps attack from Aisuru. That story that identified Forky as a 21-year-old man from Sao Paulo, Brazil who has been extremely active in the DDoS-for-hire scene since at least 2022. The FBI has seized Forky’s DDoS-for-hire domains several times over the years. Like the original Mirai botmasters, Forky also operates a DDoS mitigation service called Botshield. Forky declined to discuss the makeup of his ISP’s clientele, or to clarify whether Botshield was more of a hosting provider or a DDoS mitigation firm. However, Forky has posted on Telegram about Botshield successfully mitigating large DDoS attacks launched against other DDoS-for-hire services. In our previous interview, Forky acknowledged being involved in the development and marketing of Aisuru, but denied participating in attacks launched by the botnet. Reached for comment earlier this month, Forky continued to maintain his innocence, claiming that he also is still trying to figure out who the current Aisuru botnet operators are in real life (Forky said the same thing in our May interview). But after a week of promising juicy details, Forky came up empty-handed once again. Suspecting that Forky was merely being coy, I asked him how someone so connected to the DDoS-for-hire world could still be mystified on this point, and suggested that his inability or unwillingness to blame anyone else for Aisuru would not exactly help his case. At this, Forky verbally bristled at being pressed for more details, and abruptly terminated our interview. “I’m not here to be threatened with ignorance because you are stressed,” Forky replied. “They’re blaming me for those new attacks. Pretty much the whole world (is) due to your blog.”

 Feed

Cybersecurity company Huntress said it has observed active in-the-wild exploitation of an unpatched security flaw impacting Gladinet CentreStack and TrioFox products. The zero-day vulnerability, tracked as CVE-2025-11371 (CVSS score: 6.1), is an unauthenticated local file inclusion bug that allows unintended disclosure of system files. It impacts all versions of the software prior to and

 Feed

Dozens of organizations may have been impacted following the zero-day exploitation of a security flaw in Oracle's E-Business Suite (EBS) software since August 9, 2025, Google Threat Intelligence Group (GTIG) and Mandiant said in a new report released Thursday. "We're still assessing the scope of this incident, but we believe it affected dozens of organizations," John Hultquist, chief analyst of

 Feed

Fortra on Thursday revealed the results of its investigation into CVE-2025-10035, a critical security flaw in GoAnywhere Managed File Transfer (MFT) that's assessed to have come under active exploitation since at least September 11, 2025. The company said it began its investigation on September 11 following a "potential vulnerability" reported by a customer, uncovering "potentially suspicious

 Feed

The SOC of 2026 will no longer be a human-only battlefield. As organizations scale and threats evolve in sophistication and velocity, a new generation of AI-powered agents is reshaping how Security Operations Centers (SOCs) detect, respond, and adapt. But not all AI SOC platforms are created equal. From prompt-dependent copilots to autonomous, multi-agent systems, the current market offers

 Feed

Cybersecurity researchers have flagged a new set of 175 malicious packages on the npm registry that have been used to facilitate credential harvesting attacks as part of an unusual campaign. The packages have been collectively downloaded 26,000 times, acting as an infrastructure for a widespread phishing campaign codenamed Beamglea targeting more than 135 industrial, technology, and energy

 Feed

Cybersecurity researchers have disclosed details of an active malware campaign called Stealit that has leveraged Node.js' Single Executable Application (SEA) feature as a way to distribute its payloads. According to Fortinet FortiGuard Labs, select iterations have also employed the open-source Electron framework to deliver the malware. It's assessed that the malware is being propagated through

 Feed

A threat actor known as Storm-2657 has been observed hijacking employee accounts with the end goal of diverting salary payments to attacker-controlled accounts. "Storm-2657 is actively targeting a range of U.S.-based organizations, particularly employees in sectors like higher education, to gain access to third-party human resources (HR) software as a service (SaaS) platforms like Workday," the

2025-10
Aggregator history
Friday, October 10
WED
THU
FRI
SAT
SUN
MON
TUE
OctoberNovember