VulnHub

A new cyber campaign has emerged in Brazil, utilizing social engineering and WhatsApp hijacking to spread a banking trojan called Eternidade Stealer. This threat is significant due to its ability to dynamically retrieve command-and-control addresses, indicating a sophisticated level of exploitation targeting Brazilian users.

The article highlights a serious vulnerability in railway braking systems that can be exploited using inexpensive materials and gadgets, posing a significant risk to safety. This tampering could lead to dangerous situations for train conductors and passengers alike.

Operation WrtHug has compromised tens of thousands of outdated ASUS routers globally, primarily affecting users in Taiwan, the U.S., and Russia. The severity of this campaign highlights the risks associated with using end-of-life devices, as they can be easily hijacked to form a large botnet.

The Cybersecurity and Infrastructure Security Agency (CISA) has released a guide to help Internet Service Providers (ISPs) mitigate risks associated with Bulletproof Hosting (BPH) providers that facilitate cybercriminal activities like ransomware and phishing. The guide emphasizes the importance of collaboration and proactive measures to reduce the effectiveness of BPH infrastructure, which poses significant threats to critical systems and services.

CISA has added CVE-2025-13223, a Google Chromium V8 Type Confusion Vulnerability, to its Known Exploited Vulnerabilities Catalog due to evidence of active exploitation. This vulnerability poses significant risks to federal enterprises, prompting CISA to urge timely remediation by all organizations to mitigate potential cyberattacks.

The article highlights the critical challenge of securing environments against cyber threats, emphasizing the inadequacy of traditional security measures like Endpoint Detection and Response (EDR). It points out that reliance on reactive strategies contributes significantly to the escalating costs of cybercrime, suggesting a need for a fundamental shift towards Zero Trust security models.

The threat actor PlushDaemon has deployed a new Go-based network backdoor called EdgeStepper, which enables adversary-in-the-middle attacks by hijacking DNS queries. This redirection leads to the potential compromise of legitimate software updates, posing a significant risk to affected systems.

Fortinet has issued a warning regarding a medium-severity vulnerability in FortiWeb, tracked as CVE-2025-58034, which has been actively exploited in the wild. The flaw, categorized as an OS Command Injection vulnerability, could allow authenticated attackers to execute arbitrary commands on affected systems.