A naukri.com initiative
Hacking News
Cryptopotato
1M
317
Image Credit: Cryptopotato
Bybit Hack Aftermath: Single Whale Liquidated for $46M as BTC Dumps by $4K
- BTC's price has fallen by over $4,000 following the Bybit hack.
- Bybit confirmed a hack that drained its wallet of around $1.4 billion in ETH.
- The hack had a significant impact on the market, with BTC losing over $4,000 and altcoins also experiencing losses.
- CoinGlass reported liquidations of over $600 million, with the single-largest wrecked order worth $45.8 million.
Read Full Article
19 Likes
Coinjournal
1M
258
Image Credit: Coinjournal
Bybit suffers $1.4 billion hack, ETH drained from exchange wallet
- Bybit, a crypto exchange, has been hacked with over $1.4 billion worth of ETH and staked ETH stolen from its cold wallet.
- The CEO, Ben Zhou, confirmed the hack and stated that Bybit remains solvent and can cover the losses.
- The hack involved a sophisticated attack that manipulated the transaction and transferred the funds to an unidentified address.
- Bybit's withdrawals were unaffected, and investigations are underway to unmask the hacker's identity.
Read Full Article
15 Likes
Hackers-Arise
1M
240
Image Credit: Hackers-Arise
Open Source Intelligence (OSINT): The Versatile Email Address Search Tool
- Email addresses have become the keys to our online identities and are prime targets for hackers.
- Mosint is a versatile email address search tool for OSINT investigations.
- It offers features like email verification, data breach and password leak checking, related emails and domains, pastebin dump scanning, Google search integration, and DNS/IP lookup.
- Mosint integrates with various services to gather information, including ipapi.co, hunter.io, emailrep.io, scylla.so, psbdmp.ws, Intelligence X, BreachDirectory, and HaveIBeenPwned.
Read Full Article
14 Likes
Coinpedia
1M
63
Image Credit: Coinpedia
Bybit Hack Live Update : Biggest Crypto Hack, $1.4B ETH Hack
- Tron founder Justin Sun stated that he and his team are closely monitoring the Bybit incident following the hack. He assured that Tron will offer full support to its partners in tracking the misappropriated funds, pledging to leverage all available resources to assist in the investigation and fund recovery efforts.
- Bybit is experiencing significant outflows, with over $1.4B in ETH and stETH leaving the platform. The funds are rapidly being transferred to new addresses where they are actively being sold, including $200M in stETH already offloaded. Notably, activity has been detected from address 0x47666Fab8bd0Ac7003bce3f5C3585383F09486E2.
- Bybit detected unauthorized activity in an ETH multisig cold wallet transferring funds to a warm wallet after hackers manipulated the signing interface and altered smart contract logic. The security team and blockchain forensic experts are investigating. All other cold wallets remain secure, ensuring client funds and overall operations are unaffected.
- According to Crypto Rover, a rapid outflow exceeding $1.46 billion from Bybit has raised alarms over a potential security breach. The incident could disrupt trading and shake investor confidence. Traders are advised to closely monitor emerging developments for further impact.
Read Full Article
3 Likes
Securityaffairs
1M
326
Image Credit: Securityaffairs
B1ack’s Stash released 1 Million credit cards
- Carding website B1ack’s Stash released a collection of over 1 million unique credit and debit cards.
- The release of free samples aims to attract new customers and gain notoriety in the cybercrime ecosystem.
- The leaked data includes PAN, expiration date, CVV2, personal details, and email address.
- Banking institutions should monitor the dark web to prevent fraudulent activities.
Read Full Article
19 Likes
Securityaffairs
1M
236
Image Credit: Securityaffairs
U.S. CISA adds Craft CMS and Palo Alto Networks PAN-OS flaws to its Known Exploited Vulnerabilities catalog
- U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Craft CMS and Palo Alto Networks PAN-OS vulnerabilities to its Known Exploited Vulnerabilities catalog.
- The vulnerabilities are Craft CMS Code Injection Vulnerability (CVE-2025-23209) and Palo Alto Networks PAN-OS File Read Vulnerability (CVE-2025-0111).
- Craft CMS is susceptible to remote code execution due to compromised security keys, while Palo Alto PAN-OS allows authenticated attackers to read files accessible by the 'nobody' user.
- CISA orders federal agencies to address these vulnerabilities by March 13, 2025.
Read Full Article
14 Likes
Securelist
1M
90
Image Credit: Securelist
Angry Likho: Old beasts in a new forest
- Angry Likho, an APT group, resembling Awaken Likho, focuses on targeted attacks on employees of large organizations, mainly in Russia and Belarus.
- Their attacks involve spear-phishing emails with malicious attachments, including a self-extracting archive named FrameworkSurvivor.exe.
- The implant in the archive hides the Lumma Trojan stealer, aimed at stealing sensitive data such as banking details, usernames, passwords, and more.
- The group uses obfuscation techniques in their scripts to hide their activities, making analysis complex.
- Angry Likho's recent surge in activity in January 2025 indicates ongoing threats, with hundreds of victims in Russia and Belarus.
- The attackers target specific users with tailored spear-phishing emails and use malicious utilities from darknet forums for their operations.
- To defend against such attacks, organizations need robust security solutions, employee training, and awareness programs.
- The group's attack techniques remain consistent with periodic pauses, suggesting strategic planning in their operations.
- The report provides indicators of compromise, including file hashes, implants, bait files, and malicious domains associated with Angry Likho's activities.
- Monitoring and updating cyber intelligence data on such APT groups are essential to combat evolving cybersecurity threats effectively.
Read Full Article
5 Likes
Securityaffairs
1M
86
Image Credit: Securityaffairs
Atlassian fixed critical flaws in Confluence and Crowd
- Atlassian has patched 12 critical and high-severity vulnerabilities in its software products.
- The most severe vulnerabilities include remote code execution flaws and broken authentication and session management issues.
- The vulnerabilities affect Bamboo, Bitbucket, Confluence, Crowd, and Jira.
- Atlassian did not disclose whether the flaws have been exploited.
Read Full Article
5 Likes
Siliconangle
1M
268
Image Credit: Siliconangle
CISA and FBI warns Ghost ransomware is targeting critical infrastructure and businesses
- The US Cybersecurity and Infrastructure Agency (CISA) and the FBI have issued a joint advisory warning about the activities of Ghost ransomware, also known as Cling.
- Ghost ransomware, allegedly operated by a group in China, targets critical infrastructure, schools, healthcare, government networks, and businesses in over 70 countries for financial gain.
- The ransomware exploits unpatched vulnerabilities in popular software to gain unauthorized access to systems, deploys web shells, and uses command-line tools to establish persistence within the network.
- To defend against Ghost ransomware, proactive measures such as applying security patches, implementing network segmentation, and restricting access to critical systems are recommended.
Read Full Article
16 Likes
Securityaffairs
1M
327
Image Credit: Securityaffairs
Salt Typhoon used custom malware JumbledPath to spy U.S. telecom providers
- China-linked APT group Salt Typhoon utilizes custom malware JumbledPath to spy on U.S. telecom providers, as reported by Cisco Talos researchers.
- The APT group has been active since at least 2019, targeting government entities and telecom companies globally.
- Salt Typhoon exploited Cisco vulnerabilities, breached U.S. telecom networks, and utilized GRE tunnels for data exfiltration.
- Stolen credentials, network config captures, and intercepted traffic were used by Salt Typhoon for further access inside networks.
- The group manipulated network settings, used JumbledPath tool for packet capture, and attempted evasion techniques.
- In December 2024, Salt Typhoon targeted a Myanmar-based telecom provider, with IOCs and mitigation recommendations provided in the report.
- The group also compromised Charter Communications and Windstream, exploiting vulnerabilities in major network device vendors.
- Salt Typhoon breached a ninth U.S. telecom as part of a global cyberespionage campaign aimed at telco firms, confirmed by a White House official.
- President Biden's national security adviser disclosed breaches in telecommunications companies globally by the China-linked APT group.
- Lumen, AT&T, and Verizon reported securing networks post-cyberespionage attempts by Salt Typhoon, active for 1-2 years targeting telcos worldwide.
Read Full Article
19 Likes
Medium
1M
431
Image Credit: Medium
Thread Call Stack Cleaning
- Stack cleaning is a technique used to remove traces of injected or suspicious execution paths from a thread's call stack.
- By manipulating the return addresses in the call stack, stack cleaning can help malware evade detection by security tools.
- The process involves suspending the thread, retrieving the execution context, reading memory from the stack, zeroing out the stack values, and restoring the original context.
- Stack cleaning combined with other evasion techniques can improve stealth and persistence of malware, but advanced security solutions can still detect suspicious activity.
Read Full Article
25 Likes
Securityaffairs
1M
395
Image Credit: Securityaffairs
NailaoLocker ransomware targets EU healthcare-related entities
- NailaoLocker ransomware targeted European healthcare organizations between June and October 2024.
- The malware campaign, called The Green Nailao, involved the use of ShadowPad, PlugX, and the newly discovered NailaoLocker ransomware.
- The attack exploited a zero-day vulnerability in Check Point VPN appliances, allowing the threat actors to access sensitive information and move laterally through the network.
- Although the campaign shares similarities with China-linked APT groups, attribution remains uncertain.
Read Full Article
23 Likes
Coinpedia
1M
436
Image Credit: Coinpedia
Just In: SEC Launches New Unit to Tackle Fraud in AI, Blockchain, and Crypto
- The US Securities and Exchange Commission (SEC) has launched the Cyber and Emerging Technologies Unit (CETU) to tackle fraud in AI, blockchain, and crypto.
- The CETU will focus on fraud involving emerging technologies, such as AI, blockchain, and crypto, and aims to protect investors and promote innovation.
- Led by Laura D’Allaird, the unit comprises approximately 30 fraud specialists and attorneys across multiple SEC offices.
- The SEC's focus is on fraud involving blockchain technology and crypto assets, rather than labeling most digital assets as unregistered securities, like Chairman Gary Gensler has done.
Read Full Article
26 Likes
Siliconangle
1M
54
Image Credit: Siliconangle
New report warns of growing threat of mobile phishing targeting SMS and messaging apps
- A new report warns of a growing threat of mobile phishing targeting SMS and messaging apps.
- Mobile-specific weaknesses, such as smaller screen sizes and touch-based interactions, are exploited by cybercriminals to carry out large-scale phishing campaigns.
- Attackers leverage SMS, messaging apps, and QR codes to trick users into revealing sensitive information or downloading malicious software.
- Mobile users with smaller screens are less likely to verify URLs, and the trust in mobile messaging apps makes phishing attempts more successful.
Read Full Article
3 Likes
Securityaffairs
1M
68
Image Credit: Securityaffairs
Microsoft fixed actively exploited flaw in Power Pages
- Microsoft has fixed a privilege escalation vulnerability in Power Pages that was actively exploited in attacks.
- The vulnerability, tracked as CVE-2025-21355, allowed unauthorized attackers to execute code over a network in Microsoft Bing.
- Another vulnerability, CVE-2025-24989, allowed unauthorized attackers to elevate privileges in Power Pages.
- Microsoft has provided instructions for affected customers to review their sites for potential exploitation and clean up any affected systems.
Read Full Article
4 Likes
For uninterrupted reading, download the app