A naukri.com initiative
Hacking News
Securityaffairs
1M
324
Image Credit: Securityaffairs
B1ack’s Stash released 1 Million credit cards
- Carding website B1ack’s Stash released a collection of over 1 million unique credit and debit cards.
- The release of free samples aims to attract new customers and gain notoriety in the cybercrime ecosystem.
- The leaked data includes PAN, expiration date, CVV2, personal details, and email address.
- Banking institutions should monitor the dark web to prevent fraudulent activities.
Read Full Article
19 Likes
Securityaffairs
1M
234
Image Credit: Securityaffairs
U.S. CISA adds Craft CMS and Palo Alto Networks PAN-OS flaws to its Known Exploited Vulnerabilities catalog
- U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Craft CMS and Palo Alto Networks PAN-OS vulnerabilities to its Known Exploited Vulnerabilities catalog.
- The vulnerabilities are Craft CMS Code Injection Vulnerability (CVE-2025-23209) and Palo Alto Networks PAN-OS File Read Vulnerability (CVE-2025-0111).
- Craft CMS is susceptible to remote code execution due to compromised security keys, while Palo Alto PAN-OS allows authenticated attackers to read files accessible by the 'nobody' user.
- CISA orders federal agencies to address these vulnerabilities by March 13, 2025.
Read Full Article
14 Likes
Securelist
1M
90
Image Credit: Securelist
Angry Likho: Old beasts in a new forest
- Angry Likho, an APT group, resembling Awaken Likho, focuses on targeted attacks on employees of large organizations, mainly in Russia and Belarus.
- Their attacks involve spear-phishing emails with malicious attachments, including a self-extracting archive named FrameworkSurvivor.exe.
- The implant in the archive hides the Lumma Trojan stealer, aimed at stealing sensitive data such as banking details, usernames, passwords, and more.
- The group uses obfuscation techniques in their scripts to hide their activities, making analysis complex.
- Angry Likho's recent surge in activity in January 2025 indicates ongoing threats, with hundreds of victims in Russia and Belarus.
- The attackers target specific users with tailored spear-phishing emails and use malicious utilities from darknet forums for their operations.
- To defend against such attacks, organizations need robust security solutions, employee training, and awareness programs.
- The group's attack techniques remain consistent with periodic pauses, suggesting strategic planning in their operations.
- The report provides indicators of compromise, including file hashes, implants, bait files, and malicious domains associated with Angry Likho's activities.
- Monitoring and updating cyber intelligence data on such APT groups are essential to combat evolving cybersecurity threats effectively.
Read Full Article
5 Likes
Securityaffairs
1M
85
Image Credit: Securityaffairs
Atlassian fixed critical flaws in Confluence and Crowd
- Atlassian has patched 12 critical and high-severity vulnerabilities in its software products.
- The most severe vulnerabilities include remote code execution flaws and broken authentication and session management issues.
- The vulnerabilities affect Bamboo, Bitbucket, Confluence, Crowd, and Jira.
- Atlassian did not disclose whether the flaws have been exploited.
Read Full Article
5 Likes
Siliconangle
1M
266
Image Credit: Siliconangle
CISA and FBI warns Ghost ransomware is targeting critical infrastructure and businesses
- The US Cybersecurity and Infrastructure Agency (CISA) and the FBI have issued a joint advisory warning about the activities of Ghost ransomware, also known as Cling.
- Ghost ransomware, allegedly operated by a group in China, targets critical infrastructure, schools, healthcare, government networks, and businesses in over 70 countries for financial gain.
- The ransomware exploits unpatched vulnerabilities in popular software to gain unauthorized access to systems, deploys web shells, and uses command-line tools to establish persistence within the network.
- To defend against Ghost ransomware, proactive measures such as applying security patches, implementing network segmentation, and restricting access to critical systems are recommended.
Read Full Article
16 Likes
Securityaffairs
1M
325
Image Credit: Securityaffairs
Salt Typhoon used custom malware JumbledPath to spy U.S. telecom providers
- China-linked APT group Salt Typhoon utilizes custom malware JumbledPath to spy on U.S. telecom providers, as reported by Cisco Talos researchers.
- The APT group has been active since at least 2019, targeting government entities and telecom companies globally.
- Salt Typhoon exploited Cisco vulnerabilities, breached U.S. telecom networks, and utilized GRE tunnels for data exfiltration.
- Stolen credentials, network config captures, and intercepted traffic were used by Salt Typhoon for further access inside networks.
- The group manipulated network settings, used JumbledPath tool for packet capture, and attempted evasion techniques.
- In December 2024, Salt Typhoon targeted a Myanmar-based telecom provider, with IOCs and mitigation recommendations provided in the report.
- The group also compromised Charter Communications and Windstream, exploiting vulnerabilities in major network device vendors.
- Salt Typhoon breached a ninth U.S. telecom as part of a global cyberespionage campaign aimed at telco firms, confirmed by a White House official.
- President Biden's national security adviser disclosed breaches in telecommunications companies globally by the China-linked APT group.
- Lumen, AT&T, and Verizon reported securing networks post-cyberespionage attempts by Salt Typhoon, active for 1-2 years targeting telcos worldwide.
Read Full Article
19 Likes
Medium
1M
428
Image Credit: Medium
Thread Call Stack Cleaning
- Stack cleaning is a technique used to remove traces of injected or suspicious execution paths from a thread's call stack.
- By manipulating the return addresses in the call stack, stack cleaning can help malware evade detection by security tools.
- The process involves suspending the thread, retrieving the execution context, reading memory from the stack, zeroing out the stack values, and restoring the original context.
- Stack cleaning combined with other evasion techniques can improve stealth and persistence of malware, but advanced security solutions can still detect suspicious activity.
Read Full Article
25 Likes
Securityaffairs
1M
392
Image Credit: Securityaffairs
NailaoLocker ransomware targets EU healthcare-related entities
- NailaoLocker ransomware targeted European healthcare organizations between June and October 2024.
- The malware campaign, called The Green Nailao, involved the use of ShadowPad, PlugX, and the newly discovered NailaoLocker ransomware.
- The attack exploited a zero-day vulnerability in Check Point VPN appliances, allowing the threat actors to access sensitive information and move laterally through the network.
- Although the campaign shares similarities with China-linked APT groups, attribution remains uncertain.
Read Full Article
23 Likes
Coinpedia
1M
433
Image Credit: Coinpedia
Just In: SEC Launches New Unit to Tackle Fraud in AI, Blockchain, and Crypto
- The US Securities and Exchange Commission (SEC) has launched the Cyber and Emerging Technologies Unit (CETU) to tackle fraud in AI, blockchain, and crypto.
- The CETU will focus on fraud involving emerging technologies, such as AI, blockchain, and crypto, and aims to protect investors and promote innovation.
- Led by Laura D’Allaird, the unit comprises approximately 30 fraud specialists and attorneys across multiple SEC offices.
- The SEC's focus is on fraud involving blockchain technology and crypto assets, rather than labeling most digital assets as unregistered securities, like Chairman Gary Gensler has done.
Read Full Article
26 Likes
Siliconangle
1M
54
Image Credit: Siliconangle
New report warns of growing threat of mobile phishing targeting SMS and messaging apps
- A new report warns of a growing threat of mobile phishing targeting SMS and messaging apps.
- Mobile-specific weaknesses, such as smaller screen sizes and touch-based interactions, are exploited by cybercriminals to carry out large-scale phishing campaigns.
- Attackers leverage SMS, messaging apps, and QR codes to trick users into revealing sensitive information or downloading malicious software.
- Mobile users with smaller screens are less likely to verify URLs, and the trust in mobile messaging apps makes phishing attempts more successful.
Read Full Article
3 Likes
Securityaffairs
1M
67
Image Credit: Securityaffairs
Microsoft fixed actively exploited flaw in Power Pages
- Microsoft has fixed a privilege escalation vulnerability in Power Pages that was actively exploited in attacks.
- The vulnerability, tracked as CVE-2025-21355, allowed unauthorized attackers to execute code over a network in Microsoft Bing.
- Another vulnerability, CVE-2025-24989, allowed unauthorized attackers to elevate privileges in Power Pages.
- Microsoft has provided instructions for affected customers to review their sites for potential exploitation and clean up any affected systems.
Read Full Article
4 Likes
Securityaffairs
1M
239
Image Credit: Securityaffairs
Citrix addressed NetScaler console privilege escalation flaw
- Citrix addressed a high-severity privilege escalation vulnerability impacting NetScaler Console and NetScaler Agent.
- The vulnerability, tracked as CVE-2024-12284, allows attackers to escalate privileges under certain conditions.
- The vulnerability impacts specific versions of NetScaler Agent and NetScaler Console.
- Cloud Software Group released updated versions to address the vulnerability.
Read Full Article
14 Likes
NullTX
1M
158
Image Credit: NullTX
Urgent Warning: Active Phishing Campaign Targeting Jupiter Users
- A phishing campaign targeting Jupiter users through ads claiming a 'Jupiter Exchange exploit' is active.
- Malicious actors trick users into pasting JS code into their browser consoles leading to wallet drain.
- Deceitful operation involves fake bug reports urging users to interact with malicious links.
- The fraudsters use a malicious API (solapi.network) to access and drain crypto wallets.
- Users are warned against engaging with unsound advertisements or links and advised to verify code sources.
- Protective measures include using hardware wallets, verifying updates from platforms, and enabling 2FA.
- Jupiter users are urged to stay vigilant against phishing attempts and act promptly if compromised.
- Staying informed about cryptocurrency threats and scams is crucial for safeguarding investments.
- Disclosure: This is not trading or investment advice. Always research before investing in cryptocurrencies.
Read Full Article
9 Likes
Securelist
1M
117
Image Credit: Securelist
Managed detection and response in 2024
- Kaspersky Managed Detection and Response service (MDR) provides round-the-clock monitoring and threat detection.
- In 2024, the MDR infrastructure processed an average of 15,000 telemetry events per host daily, with over two high-severity incidents detected per day.
- The largest concentration of Kaspersky MDR customers is in Europe, the CIS, and the META regions.
- General observations from 2024 include decreased high-severity incidents with increased complexity, a rise in human-driven targeted attacks, attackers often returning after a successful breach, prevalent use of Living off the Land techniques, and top threats being User Execution and Phishing.
Read Full Article
7 Likes
Securityaffairs
1M
429
Image Credit: Securityaffairs
Palo Alto Networks warns that CVE-2025-0111 flaw is actively exploited in attacks
- Palo Alto Networks warns that the vulnerability CVE-2025-0111 is actively exploited with two other flaws to compromise PAN-OS firewalls.
- The vulnerability CVE-2025-0111 is a file read issue in PAN-OS, allowing an attacker to read files that are readable by the 'nobody' user.
- Palo Alto Networks has observed exploit attempts chaining CVE-2025-0108 with CVE-2024-9474 and CVE-2025-0111 on unpatched PAN-OS web management interfaces.
- The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the CVE-2025-0108 vulnerability to its Known Exploited Vulnerabilities catalog.
Read Full Article
25 Likes
For uninterrupted reading, download the app