VulnHub

Hackers linked to the Russian group Sandworm have been targeting IT professionals and system administrators by sending fake job offers that include a malicious version of the WireGuard VPN client. This tactic has been in play since at least May, allowing attackers to compromise systems under the guise of a legitimate hiring process. Once installed, the trojanized VPN client can give hackers access to sensitive network information and potentially lead to larger security breaches. This incident is particularly concerning as it exploits the trust between job seekers and employers, highlighting the need for heightened vigilance among IT professionals regarding unsolicited job offers and software downloads. Organizations should ensure their employees remain cautious and verify the authenticity of any job-related communications or software.

The article discusses various cybersecurity threats and vulnerabilities, including new malware variants and attack techniques. Notably, 'Ghostjacking' is highlighted as a technique used by attackers to take control of devices remotely without user consent. This poses a significant risk to users as it can lead to unauthorized access to personal information and devices. Additionally, the article covers the importance of Software Bill of Materials (SBOMs) in enhancing software security by providing transparency about software components. Companies need to prioritize implementing SBOMs to mitigate risks associated with supply chain attacks. Overall, these emerging threats underline the necessity for users and organizations to stay vigilant and adopt stronger security practices.

Microsoft has released its monthly security updates, addressing a total of 398 vulnerabilities, including a serious zero-day flaw that is currently being exploited in attacks. This particular vulnerability, tracked as CVE-2026-68820, affects a core Windows kernel driver responsible for network socket operations. Attackers who already have code running on a targeted machine can exploit this flaw to gain elevated privileges, potentially allowing them to execute commands with SYSTEM-level access. Given the active exploitation, users and organizations should prioritize applying the patch to mitigate the risk of unauthorized access. The patch is crucial for maintaining system security and preventing further attacks.

Researchers from Palo Alto Networks Unit 42 have identified a new version of the Kimwolf botnet, known as Kimwolf v7, which targets Android devices and Internet of Things (IoT) devices. This upgraded botnet enhances its ability to launch distributed denial-of-service (DDoS) attacks by disguising its HTTP/2 traffic to resemble legitimate web browsing. This makes it harder for security systems to detect and mitigate the attacks. The discovery of Kimwolf v7 raises concerns for users of vulnerable Android and IoT devices, as attackers can exploit these weaknesses to disrupt services and potentially gain unauthorized access to sensitive information. Companies and users need to be vigilant and ensure their devices are secured against such threats.

The Computer Emergency Response Team of Ukraine (CERT-UA) has reported a new social engineering scam linked to Russian threat actors known as UAC-0145, a subgroup of Sandworm. The attackers are posing as recruiters and targeting IT professionals in Ukraine, attempting to convince them to install a malicious VPN. This VPN is designed to execute commands on the victims' systems, effectively compromising their security. The campaign is particularly concerning given the ongoing tensions in the region and the potential for sensitive information to be exploited. IT workers should be cautious of unsolicited job offers and verify the legitimacy of any communications they receive.

Zoom has addressed a serious vulnerability in its software that could allow a participant in a video meeting to execute malicious code on another user’s device via the annotation feature. This flaw, known as CVE-2026-53413, is categorized as a zero-click vulnerability, meaning it does not require any interaction from the victim to be exploited. Discovered by A Security, the issue is part of a broader update where Zoom patched a total of four vulnerabilities. The existence of such a flaw raises significant concerns about user safety and privacy during online meetings, as it could potentially lead to unauthorized access to sensitive information. Users are advised to update their Zoom applications to the latest version to protect themselves from possible exploitation.

Adobe has issued a warning for users of its ColdFusion and Campaign Classic products to address serious security flaws that could allow attackers to execute arbitrary code or cause denial-of-service attacks. These vulnerabilities pose significant risks, as they could let malicious actors take control of systems or disrupt services. Users of these applications are urged to prioritize patching to protect their data and ensure operational continuity. The company has not specified if these vulnerabilities are currently being exploited in the wild, but the urgency of the advisory indicates a pressing need for action. Patching is essential to mitigate the risks posed by these flaws.

ExfilSquad, a new cybercrime group that surfaced in mid-2026, has targeted 13 organizations by exploiting cloud portals to steal sensitive data. Unlike traditional ransomware attacks, this group focuses on data theft and then threatens to release the stolen information to amplify the damage. They have started distributing the stolen data through torrents, making it more difficult for affected organizations to contain the breach. Researchers from Resecurity are actively monitoring ExfilSquad's activities as they announce new victims. This incident raises concerns about the security of cloud services and the need for organizations to strengthen their defenses against data theft.

Iranian hackers have expanded their cyberattacks on U.S. water infrastructure, recently targeting facilities in New Jersey and Alabama. This brings the total number of affected states to at least 12 since late July. While the attacks have caused limited disruption so far, they raise significant concerns about the security of essential public services. The ongoing campaign emphasizes the vulnerabilities in critical infrastructure, making it crucial for state and local governments to enhance their cybersecurity measures. As these incidents become more frequent, the potential for more serious consequences increases, highlighting the need for vigilance in protecting water supply systems.