Cybersecurity, AI, etc.
Red teaming (offensive research, new TTPs, exploitation techniques, PoC releases, adversary simulation findings)
Attackers used a compromised BigCommerce application key held by Ribon to access customer data, according to SecurityWeek. The incident highlights the access risk created when third-party applications hold broad or…
A malicious npm package named indexed-btree, presented as the legitimate sorted-btree package, accumulated millions of downloads, SecurityWeek reported. The package reportedly hid a malware trigger in a prototype method. Development…
A Chinese threat actor has targeted vulnerable Zyxel GS1900 switches worldwide for sensitive-information exfiltration, SecurityWeek reported. The activity follows reporting on active exploitation of a flaw affecting the switch line.…
WordPress has patched a vulnerability researchers call Click2Shell. According to SecurityWeek, the issue could let an attacker install themes and achieve remote code execution. Site owners should apply the relevant…
CISA added four vulnerabilities to its Known Exploited Vulnerabilities Catalog on September 22 after evidence of active exploitation. The agency’s alert identifies the additions as affecting Check Point products. Organizations…
What happened: CyberInsider reported on PAYLOAD ransomware activity that reportedly uses Windows Group Policy as part of attacks designed to cause disruption without relying on traditional bulk file encryption. The…
What happened: Multiple cybersecurity outlets reported that the ShinyHunters group claimed control of infrastructure associated with the Cl0p ransomware operation’s leak site and used it to demand payment. The claims…
A PAYLOAD operation used malicious Group Policy Objects to disable defenses and disrupt a Windows domain without deploying a conventional ransomware encryptor.
SentinelOne linked North Korean group Jade Sleet to an Indian IT services compromise involving a DevOps engineer’s Mac and two Rust-based macOS backdoors.
A newly documented Node.js remote-access trojan uses ClickFix lures and a Polygon smart contract to discover active WebSocket command-and-control infrastructure.