Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Chilean National Ext ...

 Governance

A major stolen credit card data trafficking case has drawn international attention after a Chilean national was extradited to the United States for allegedly selling tens of thousands of compromised payment card details through online channels. According to the U.S. Department of Justice, Alex Rodrigo Valenzuela   show more ...  

Monje, also known as “VAL4K,” was extradited from Chile to the United States on February 25, 2026, and arraigned in federal court in Salt Lake City. The 24-year-old faces charges tied to stolen credit card data trafficking and unlawful transfer of identification information to facilitate criminal activity. The indictment alleges that between May 2021 and August 2023, Valenzuela Monje operated an illegal online card shop that distributed unauthorized access devices—commonly referred to in cybercrime circles as “dumps”—through Telegram channels. Telegram Carding Marketplace Allegedly Distributed Over 26,000 Stolen Cards Court documents claim that the accused managed Telegram channels named MacacoCC Collective and Novato Carding, offering payment card data linked to thousands of U.S. consumers. Investigators allege that under just one credit card brand alone, the operation trafficked information tied to approximately 26,528 cards. The stolen credit card data trafficking operation reportedly included sensitive data such as account numbers, cardholder names, expiration dates, and CVV codes, details that can enable fraudulent transactions and identity-based financial crimes. Authorities say the use of Telegram reflects a broader trend in carding cybercrime, where threat actors rely on encrypted messaging platforms to evade detection while running scalable digital marketplaces. This model has become increasingly common across dark web ecosystems, allowing cybercriminals to reach global buyers without maintaining traditional web infrastructure. International Cybercrime Extradition Signals Stronger Enforcement Push The extradition process began after a sealed indictment was issued by a federal grand jury in 2023. The United States formally requested extradition, which was initially approved by the Chilean Supreme Court in April 2025. Following appeals, Valenzuela Monje was arrested in January 2026 before being transferred to U.S. authorities. The case was investigated by the Federal Bureau of Investigation (FBI) with support from international partners, highlighting the growing coordination behind international cybercrime extradition efforts. “I want to thank our federal partners for their dedication in investigating individuals in foreign countries who use the internet to commit crimes against our citizens,” said U.S. Attorney Melissa Holyoak of the District of Utah. “Individuals may believe they can hide behind foreign borders, but the United States is committed to investigating and prosecuting these cybercrimes targeting Americans.” “This extradition sends a clear message to cybercriminals everywhere that geography will not shield you from accountability,” said Special Agent in Charge Robert Bohls of the Salt Lake City FBI. “Even when operating from abroad, those who exploit technology to victimize American companies and citizens will be identified, located, and brought to justice. Our international partnerships, alongside our work with the Utah Department of Public Safety, remain among the FBI's most powerful tools in targeting and dismantling cyber threats. Stolen Credit Card Data Trafficking Continues to Scale Through Digital Platforms The stolen credit card data trafficking case reflects a larger cybersecurity reality: digital financial crime is no longer limited by geography. Messaging platforms, cryptocurrency payments, and automated data distribution tools have significantly lowered the barrier for cybercriminal operations. While law enforcement actions like this extradition demonstrate progress, the persistence of carding marketplaces suggests that enforcement alone may not be enough. Financial institutions, technology platforms, and consumers must all play a role in reducing the value of stolen data through stronger fraud detection and identity verification controls. Valenzuela Monje has pleaded not guilty, and the case will proceed through the U.S. judicial system. As investigations continue, the incident serves as a reminder that stolen credit card data trafficking remains one of the most active—and profitable—forms of cybercrime in today’s digital economy.

image for Ring Camera Doorbell ...

 Firewall Daily

A Super Bowl commercial for Ring camera doorbells ignited a wave of criticism across the United States, intensifying an already heated national conversation about surveillance and privacy. The advertisement aired during the Super Bowl, the championship game of American football, and one of the most-watched television   show more ...  

events in the country.   With millions of people tuning in, companies traditionally compete for attention with high-budget, humorous or emotionally compelling commercials. Viewers often expect to be entertained and frequently revisit standout ads on platforms like YouTube within hours of the broadcast. But this particular commercial, produced by Ring, did not generate admiration. Instead, it drew a sharp backlash.  The company is best known for its Ring camera doorbells that double as security cameras, used its Super Bowl advertisement to introduce a new feature designed to help users locate lost pets. Rather than receiving praise or indifference, the company faced overwhelmingly negative reactions. Critics described the feature as intrusive, with some labeling it “Orwellian surveillance.” Lawmakers voiced concern, lawsuits were threatened, and reports surfaced that thousands of customers canceled their subscriptions.  The outcry became significant enough that Ring ended a partnership with Flock, a company specializing in automatic license plate readers (ALPRs). The partnership would have allowed Ring to access video databases tied to its security cameras.  From Start-Up to Subsidiary: Ring’s Controversial Path  Ring was founded in 2013 as a technology start-up focused on home security cameras and smart doorbells. The company quickly attracted investors and consumer attention. In 2018, it was acquired by Amazon, a move that accelerated its growth and broadened its reach.  However, expansion brought controversy.  Over the years, Ring has partnered with local police departments to promote its products. In some cases, customers signed agreements that critics argued allowed law enforcement broad access to footage captured by Ring camera doorbells. The company has also faced scrutiny over facial recognition features that stored images of individuals who appeared in front of its security cameras. In one high-profile case, Ring paid $5.8 million to settle allegations that employees accessed customers’ private video data without authorization.  Surveillance Beyond the Suburbs  The controversy surrounding Ring camera doorbells is unfolding against a backdrop of widespread surveillance in major cities, as reported by the Fair Observer. Washington, DC reportedly has more than 30,000 cameras, making it one of the most surveilled cities in the world. New York City has long grappled with debates about the use, and potential misuse, of surveillance technology.  Much of the growth in public monitoring systems followed the September 11, 2001 attacks. Since then, governments have expanded camera networks in the name of public safety. Yet concerns about abuse have persisted, whether surveillance tools are controlled by public authorities or private firms.  Why the Backlash Was So Intense  Surveillance technology is already embedded in daily life. Cameras monitor traffic and storefronts. Smartphones track user locations. Apps and websites collect behavioral data. Yet the public response to the Super Bowl advertisement shows that visibility and proximity matter.  For many Americans, abstract data collection feels distant. A camera mounted at eye level on a neighbor’s front door, however, recording passersby in real time, feels personal. Ring camera doorbells transform sidewalks and shared spaces into monitored zones. That immediacy intensifies unease.  Public debates around protest monitoring and digital tracking have heightened fears that surveillance tools could suppress dissent or disproportionately target certain communities. During periods of civil unrest, reporting has shown that expanded monitoring can raise concerns about free expression and civil liberties.  Surveys consistently indicate that Americans value privacy and want greater control over who can access their personal data. The backlash against Ring’s Super Bowl advertisement was therefore about more than one feature on a device. It reflected broader discomfort with how normalized security cameras and digital surveillance have become. 

image for CISA Warns RESURGE M ...

 Cyber News

The latest update on RESURGE malware from Cybersecurity and Infrastructure Security Agency (CISA) signals a concerning reality for network defenders: stealth-focused malware is becoming harder to detect and easier to maintain inside enterprise infrastructure. In its updated CISA malware analysis report, the agency   show more ...  

revealed that malware can remain dormant for long periods on compromised Ivanti Connect Secure devices, activating only when attackers attempt remote access. This dormant behavior increases the risk level because organizations may believe their systems are clean while the threat remains quietly embedded in the network. The updated findings build on the original March 2025 report but introduce deeper technical insights into how RESURGE malware leverages advanced encryption, forged certificates, and Secure Shell (SSH) tunnels to maintain covert command-and-control communication. RESURGE Malware Uses Stealth and Dormancy to Evade Detection According to the updated analysis, malware is designed to exploit the Ivanti Connect Secure vulnerability CVE-2025-0282 and establish persistence through network-level evasion techniques. Unlike traditional malware that triggers alerts through continuous activity, this network evasion malware remains inactive until a remote actor connects to the compromised device. This tactic allows it to bypass routine monitoring tools that rely heavily on behavioral detection. CISA noted that the malware modifies files, manipulates integrity checks, and deploys web shells directly to the Ivanti boot disk—methods that make removal more complex and detection less straightforward. “As America’s cyber defense agency, the Cybersecurity and Infrastructure Security Agency remains fully committed to safeguarding the nation’s critical infrastructure, even during the ongoing multi week shutdown of the Department of Homeland Security,” said CISA Acting Director Dr. Madhu Gottumukkala. “The vulnerabilities detailed in this updated Malware Analysis Report pose real risks to people, property, and essential systems. Given the ease with which these vulnerabilities can be exploited through sophisticated network-level evasion, we determined it was imperative to provide network defenders with enhanced insights to respond faster to the RESURGE malware.” The emphasis on critical infrastructure highlights why RESURGE malware is not just another vulnerability exploitation case—it represents a persistent access tool that attackers can reuse over time. Advanced Encryption and Fake TLS Certificates Strengthen RESURGE Malware One of the most concerning aspects of the updated malware analysis is its use of advanced cryptographic techniques and forged Transport Layer Security (TLS) certificates. CISA revealed that the malware uses Elliptical Curve Cryptography (ECC) alongside fake TLS certificates not simply for encryption but for authentication—allowing attackers to verify they are communicating with an infected device rather than a legitimate server. This approach makes the SSH command and control malware far more difficult to detect using traditional inspection tools. The report also identified TLS fingerprinting and CRC32 hashing mechanisms that help the malware distinguish between benign and malicious traffic. These layered techniques show a clear shift toward stealth-first malware design. “By expanding on the technical details in the original Malware Analysis Report (MAR) on RESURGE, we are equipping network defenders with a deeper, more complete understanding of this malware—along with the tools they need to identify, mitigate, and respond effectively,” said Nick Andersen, CISA Executive Assistant Director for Cybersecurity. “ Our updated analysis shows that RESURGE can remain dormant and undetected on Ivanti Connect Secure devices, meaning the threat is very much active.” Why the Update Matters for Enterprise Security The updated RESURGE malware report reflects a broader trend in modern cyber threats: attackers are prioritizing persistence over immediate impact. Instead of launching noisy attacks, threat actors are embedding long-term access mechanisms into network infrastructure. CISA’s findings also reinforce the importance of proactive patching and threat hunting, especially for organizations running remote access appliances like Ivanti Connect Secure. Another key takeaway is that relying solely on automated scanning tools is no longer enough. Dormant malware, by design, avoids detection until it is too late. CISA has urged organizations to apply mitigation guidance tied to CVE-2025-0282 and use updated indicators of compromise to detect potential infections.

image for Vietnam Announces Na ...

 Firewall Daily

Vietnam has announced plans to focus on building a cybersecurity firewall. The statement was delivered by Public Security Minister Lương Tam Quang on Feb. 7, following the closing session of the Communist Party of Vietnam’s 14th National Congress.  It was the first time a senior official explicitly used the term   show more ...  

“cybersecurity firewall” to describe the country’s direction in digital governance. While Vietnam has long been regarded internationally as operating one of the most tightly controlled online environments, authorities had not previously declared an intention to construct what they now describe as a national cybersecurity firewall.  The announcement coincides with sweeping reforms to the country’s cybersecurity law framework.  A New Cybersecurity Law Anchors the Digital Governance Strategy  On Dec. 10, 2025, the 15th National Assembly passed a new Cybersecurity Law that will take effect on July 1, 2026. Drafted by the Ministry of Public Security (MPS), the legislation replaces both the 2018 Cybersecurity Law and the 2015 Law on Information Security.  The 2025 cybersecurity law introduces new language into Vietnam’s digital governance architecture. Notably, Point d, Clause 2, Article 10 states that authorities will “study the development of a national firewall system.” This is the first time such terminology has appeared in Vietnamese legislation, formally embedding the concept of a cybersecurity firewall within statutory law.  The inclusion of this provision represents a structural shift in how cybersecurity law is framed in the country, elevating technical filtering and monitoring infrastructure to the level of national policy objectives, as reported by The Vietnamese Magazine. Draft Technical Standards Outline Cybersecurity Firewall Requirements  Approximately two months after the law’s passage, the Ministry of Public Security released a draft regulation for public comment titled “National Technical Standard on Cybersecurity—Firewall—Basic Technical Requirements.” The document provides insight into the proposed technical architecture of the cybersecurity firewall.  According to the draft, firewall systems meeting national standards would be mandatory infrastructure for monitoring and filtering internet activity. These devices would be capable of filtering traffic and conducting deep packet inspection (DPI).  The proposal also includes SSL/TLS inspection capabilities. SSL/TLS protocols—indicated by the “https” prefix in web addresses—are commonly used to encrypt communications between users and websites. Under the draft framework, firewall systems would be able to decrypt encrypted communications, inspect their contents, and then re-encrypt them before forwarding the data.   In addition, the draft calls for integrating user identity data into individualized control policies. Web-filtering mechanisms would rely on blacklists containing at least 100,000 domain names. These blacklists are defined as collections of IP addresses, domains, and URLs subject to restriction under information security policies, aimed at blocking content or activity considered “undesirable.”  Data Logging, Risk Assessment, and Centralized Oversight  Beyond filtering capabilities, the proposed cybersecurity firewall would require network devices to log detailed information for every user session. Logged data would include time stamps, source and destination addresses, protocols used, and system responses.  User activity would then be assessed and assigned a “risk level.” If defined thresholds are exceeded, automated controls or alerts would be triggered and transmitted to cybersecurity authorities. This risk-based monitoring model adds another layer to the country’s digital governance structure, combining surveillance mechanisms with automated enforcement tools.  Separate draft regulations implementing the 2025 cybersecurity law would further obligate telecommunications and internet service providers to retain IP address identification data linked to subscriber information for a minimum of 12 months. Companies would also be required to establish direct technical connections enabling the transfer of IP data to the Ministry’s specialized cybersecurity force.  Under the proposed rules, user information must be provided within 24 hours upon request, or within three hours in urgent cases. All user data would be stored domestically at the MPS’s National Data Center. 

image for CVE-2026-3102: macOS ...

 Business

Can a computer be infected with malware simply by processing a photo — particularly if that computer is a Mac, which many still believe (wrongly) to be inherently resistant to malware? As it turns out, the answer is yes — if you’re using a vulnerable version of ExifTool or one of the many apps built based on it.   show more ...  

ExifTool is a ubiquitous open-source solution for reading, writing, and editing image metadata. It’s the go-to tool for photographers and digital archivists, and is widely used in data analytics, digital forensics, and investigative journalism. Our GReAT experts discovered a critical vulnerability — tracked as CVE-2026-3102 — which is triggered during the processing of malicious image files containing embedded shell commands within their metadata. When a vulnerable version of ExifTool on macOS processes such a file, the command is executed. This allows a threat actor to perform unauthorized actions in the system, such as downloading and executing a payload from a remote server. In this post, we break down how this exploit works, provide actionable defense recommendations, and explain how to verify if your system is vulnerable. What is ExifTool? ExifTool is a free, open-source application addressing a niche but critical requirement: it extracts metadata from files, and enables the processing of both that data and the files themselves. Metadata is the information embedded within most modern file formats that describes or supplements the main content of a file. For instance, in a music track, metadata includes the artist’s name, song title, genre, release year, album cover art, and so on. For photographs, metadata typically consists of the date and time of a shot, GPS coordinates, ISO and shutter speed settings, and the camera make and model. Even office documents store metadata, such as the author’s name, total editing time, and the original creation date. ExifTool is the industry leader in terms of the sheer volume of supported file formats, as well as the depth, accuracy, and versatility of its processing capabilities. Common use cases include: Adjusting dates if they’re incorrectly recorded in the source files Moving metadata between different file formats (from JPG to PNG and so on) Pulling preview thumbnails from professional RAW formats (such as 3FR, ARW, or CR3) Retrieving data from niche formats, including FLIR thermal imagery, LYTRO light-field photos, and DICOM medical imaging Renaming photo/video (etc.) files based on the time of actual shooting, and synchronizing the file creation time and date accordingly Embedding GPS coordinates into a file by syncing it with a separately stored GPS track log, or adding the name of the nearest populated area The list goes on and on. ExifTool is available both as a standalone command-line application and an open-source library, meaning its code often runs under the hood of powerful, multi-purpose tools; examples include photo organization systems like Exif Photoworker and MetaScope, or image processing automation tools like ImageIngester. In large digital libraries, publishing houses, and image analytics firms, ExifTool is frequently used in automated mode, triggered by internal enterprise applications and custom scripts. How CVE-2026-3102 works To exploit this vulnerability, an attacker must craft an image file in a certain way. While the image itself can be anything, the exploit lies in the metadata — specifically the DateTimeOriginal field (date and time of creation), which must be recorded in an invalid format. In addition to the date and time, this field must contain malicious shell commands. Due to the specific way ExifTool handles data on macOS, these commands will execute only if two conditions are met: The application or library is running on macOS The -n (or –printConv) flag is enabled. This mode outputs machine-readable data without additional processing, as is. For example, in -n mode, camera orientation data is output simply, inexplicably, as “six”, whereas with additional processing, it becomes the more human-readable “Rotated 90 CW”. This “human-readability” prevents the vulnerability from being exploited A rare but by no means fantastical scenario for a targeted attack would look like this: a forensics laboratory, a media editorial office, or a large organization that processes legal or medical documentation receives a digital document of interest. This can be a sensational photo or a legal claim — the bait depends on the victim’s line of work. All files entering the company undergo sorting and cataloging via a digital asset management (DAM) system. In large companies, this may be automated; individuals and small firms run the required software manually. In either case, the ExifTool library must be used under the hood of this software. When processing the date of the malicious photo, the computer where the processing occurs is infected with a Trojan or an infostealer, which is subsequently capable of stealing all valuable data stored on the attacked device. Meanwhile, the victim could easily notice nothing at all, as the attack leverages the image metadata while the picture itself may be harmless, entirely appropriate, and useful. How to protect against the ExifTool vulnerability GReAT researchers reported the vulnerability to the author of ExifTool, who promptly released version 13.50, which is not susceptible to CVE-2026-3102. Versions 13.49 and earlier must be updated to remediate the flaw. It’s critical to ensure that all photo processing workflows are using the updated version. You should verify that all asset management platforms, photo organization apps, and any bulk image processing scripts running on Macs are calling ExifTool version 13.50 or later, and don’t contain an embedded older copy of the ExifTool library. Naturally, ExifTool — like any software — may contain additional vulnerabilities of this class. To harden your defenses, we also recommend the following: Isolate the processing of untrusted files. Process images from questionable sources on a dedicated machine or within a virtual environment, strictly limiting its access to other computers, data storage, and network resources. Continuously track vulnerabilities along the software supply chain. Organizations that rely on open-source components in their workflows can use Open Source Software Threats Data Feed for tracking. Finally, if you work with freelancers or self-employed contractors (or simply allow BYOD), only allow them to access your network if they have a comprehensive macOS security solution installed. Still think macOS is safe? Then read about these Mac threats: Banshee: A stealer targeting macOS users Are Macs safe? Threats to macOS users Infostealer has entered the chat AirBorne: Attacks on Apple devices through vulnerabilities in AirPlay Hacking Android, macOS, iOS, and Linux through a Bluetooth vulnerability

 Feed

Cybersecurity researchers have disclosed a new iteration of the ongoing Contagious Interview campaign, where the North Korean threat actors have published a set of 26 malicious packages to the npm registry. The packages masquerade as developer tools, but contain functionality to extract the actual command-and-control (C2) by using seemingly harmless Pastebin content as a dead drop resolver and

 Feed

This week is not about one big event. It shows where things are moving. Network systems, cloud setups, AI tools, and common apps are all being pushed in different ways. Small gaps in access control, exposed keys, and normal features are being used as entry points. The pattern becomes clear only when you see everything together. Faster scans, smarter misuse of trusted services, and steady

 Feed

Most SaaS teams remember the day their user traffic started growing fast. Few notice the day bots started targeting them. On paper, everything looks great: more sign-ups, more sessions, more API calls. But in reality, something feels off: Sign-ups increase, but users aren’t activating. Server costs rise faster than revenue. Logs are filled with repeated requests from strange user agents. If

 Feed

A recently disclosed security flaw patched by Microsoft may have been exploited by the Russia-linked state-sponsored threat actor known as APT28, according to new findings from Akamai. The vulnerability in question is CVE-2026-21513 (CVSS score: 8.8), a high-severity security feature bypass affecting the MSHTML Framework. "Protection mechanism failure in MSHTML Framework allows an unauthorized

 Feed

Cybersecurity researchers have disclosed details of a now-patched security flaw in Google Chrome that could have permitted attackers to escalate privileges and gain access to local files on the system. The vulnerability, tracked as CVE-2026-0628 (CVSS score: 8.8), has been described as a case of insufficient policy enforcement in the WebView tag. It was patched by Google in early January 2026

 Feed

Google has announced a new program in its Chrome browser to ensure that HTTPS certificates are secure against the future risk posed by quantum computers. "To ensure the scalability and efficiency of the ecosystem, Chrome has no immediate plan to add traditional X.509 certificates containing post-quantum cryptography to the Chrome Root Store," the Chrome Secure Web and Networking Team said. "

2026-03
Aggregator history
Monday, March 02
SUN
MON
TUE
WED
THU
FRI
SAT
March