VulnHub

Security researchers have identified two new malware strains specifically targeting Linux-based network devices. These malicious programs are being used by financially motivated cybercriminals, marking a shift from their previous association with nation-state espionage. The malware can facilitate distributed denial-of-service (DDoS) attacks and enable unauthorized cryptocurrency mining. This development is concerning as it indicates that attackers are now exploiting vulnerabilities that were once primarily used for geopolitical purposes. Organizations using Linux network devices need to be vigilant and enhance their security measures to protect against these evolving threats.

The Vidar 2.0 malware campaign is specifically targeting gamers by disguising malicious links as attractive images on GitHub. These links lure users into downloading malware that can steal cryptocurrency and gaming account credentials. Gamers, who often seek an advantage in their online activities, are particularly vulnerable to this tactic. The campaign's use of a trusted platform like GitHub makes it even more deceptive. It's crucial for gamers to be cautious about the sources of the links they click and to verify the legitimacy of downloads to protect their accounts and digital assets.

The Cybersecurity and Infrastructure Security Agency (CISA) has directed U.S. federal agencies to address a vulnerability in the Zimbra Collaboration Suite (ZCS) that is currently being exploited in the wild. This flaw allows for cross-site scripting attacks, which can enable attackers to execute malicious scripts in the context of a user's session. Affected organizations need to act quickly to secure their servers to prevent unauthorized access and data breaches. The urgency of this directive underscores the importance of maintaining up-to-date security practices, especially for government entities that handle sensitive information. Users of ZCS should ensure their systems are patched as soon as possible to mitigate the risk posed by this vulnerability.

The Interlock ransomware gang has been actively exploiting a serious remote code execution vulnerability in Cisco's Secure Firewall Management Center (FMC) software since late January. This flaw, classified as having maximum severity, allows attackers to execute arbitrary code on affected systems, putting organizations at significant risk. Companies using this software should be particularly vigilant, as the vulnerability is being exploited in ongoing attacks. Cisco has not yet released a patch to address this issue, which raises concerns about the potential for widespread impact. Organizations relying on Cisco FMC should prioritize security measures and closely monitor any unusual activity to safeguard their networks.

Amazon Threat Intelligence has issued a warning regarding an active ransomware campaign known as Interlock, which is exploiting a significant vulnerability in Cisco's Secure Firewall Management Center (FMC) Software. This vulnerability, identified as CVE-2026-20131, has a maximum severity score of 10.0 and stems from an insecure deserialization of user-supplied Java byte streams. This flaw could allow attackers to gain root access without authentication, posing a serious risk to organizations using affected Cisco products. The exploitation of this vulnerability is concerning as it enables unauthorized access, potentially leading to data breaches and system compromises. Companies using Cisco FMC Software must take immediate action to protect their systems from this ongoing threat.

Marquis, a financial services provider based in Texas, recently reported that a ransomware attack in August 2025 compromised the personal data of over 672,000 individuals. The breach also had significant operational impacts, affecting 74 banks across the United States. The stolen data may include sensitive information, raising concerns about identity theft and privacy for those affected. This incident highlights the vulnerabilities in the financial sector and the ongoing threat posed by ransomware groups. Organizations in this space need to enhance their cybersecurity measures to protect both their operations and customer data.

A malicious Chrome extension called ShieldGuard was discovered to be a crypto scam masquerading as a security tool. This extension primarily targeted users looking to protect their cryptocurrency wallets but instead siphoned off sensitive wallet information and drained user data. Researchers found that once installed, the extension would exploit its permissions to access and transfer funds from users' crypto wallets. This incident affects anyone who installed the ShieldGuard extension, highlighting the ongoing risks of using unverified browser extensions in the cryptocurrency space. Users are urged to be cautious and only download extensions from reputable sources to safeguard their assets.

A new exploit kit called 'Darksword' is being used to target iPhones, particularly affecting users of cryptocurrency wallet applications. This exploit allows attackers to steal various personal information from compromised devices. The existence of Darksword raises significant concerns, especially for those who handle sensitive financial data on their mobile devices. As users increasingly rely on their phones for managing cryptocurrencies, the risk of falling victim to such attacks is growing. It’s crucial for iPhone users to stay vigilant and ensure their devices are updated to protect against these vulnerabilities.