VulnHub

Real-time Cybersecurity News

'BlackSanta' EDR Killer Targets HR Workflows

darkreading
Actively Exploited
Malware

Overview

A group of Russian-speaking cybercriminals has launched a campaign that manipulates human resources workflows to spread malware. This malware is designed to bypass security measures, enabling the attackers to steal sensitive data from organizations without raising alarms. Companies with HR processes that rely heavily on automated workflows are particularly vulnerable to these tactics. As the attack goes undetected, it poses a significant risk to the confidentiality of employee information and company data. Organizations need to be vigilant in monitoring their systems and enhancing their security protocols to combat these kinds of intrusions.

Key Takeaways

  • Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
  • Affected Systems: HR software workflows, sensitive employee data systems
  • Action Required: Organizations should enhance monitoring of HR workflows and implement robust security measures to detect unusual activities.
  • Timeline: Newly disclosed

Original Article Summary

A campaign by Russian-speaking cyberattackers hijacks workflows to deliver security-busting malware, allowing attackers to steal data without detection.

Impact

HR software workflows, sensitive employee data systems

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Organizations should enhance monitoring of HR workflows and implement robust security measures to detect unusual activities.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Malware.

Read Original Article

Related Coverage

FBI says even in an AI-powered world, security basics still matter

CyberScoop

The FBI has issued a statement emphasizing that while artificial intelligence is accelerating the pace of cyber attacks, the core nature of these attacks remains unchanged. Jason Bilnoski, an official with the FBI, pointed out that traditional security measures are still essential, despite the advancements in technology. This serves as a reminder to organizations and individuals that basic cybersecurity practices, such as strong passwords and regular software updates, are crucial for protection against evolving threats. The FBI's message is particularly relevant as cybercriminals increasingly use AI to enhance their tactics, making it imperative for everyone to stay vigilant and adhere to established security protocols. Neglecting these fundamentals can lead to significant vulnerabilities, regardless of technological advancements.

Mar 10, 2026

Attackers exploit FortiGate devices to access sensitive network information

Security Affairs

Attackers are targeting FortiGate devices to infiltrate networks and steal sensitive configuration data, including service account credentials and network information. Researchers from SentinelOne have identified that these breaches often occur due to vulnerabilities or weak login credentials associated with FortiGate devices. Once attackers gain access to a corporate network, they can extract configuration files that may expose critical information. This poses a significant risk to organizations that rely on FortiGate for network security, as compromised credentials can lead to further exploitation. Companies using FortiGate devices should prioritize reviewing their security practices and updating configurations to prevent unauthorized access.

Mar 10, 2026

Federal judge blocks Perplexity’s AI browser from making Amazon purchases

CyberScoop

A federal judge has ruled that Perplexity's AI browser cannot make purchases on Amazon, following a lawsuit filed by Amazon last year. The lawsuit accused Perplexity of computer fraud, claiming that its AI browser accessed password-protected accounts to buy items without authorization. This decision is significant as it addresses the legal implications of AI technology interacting with online marketplaces. The ruling raises questions about the ethical use of AI in e-commerce and the protection of user accounts. It also highlights the ongoing legal battles surrounding AI capabilities and their potential for misuse.

Mar 10, 2026

Critical defect in Java security engine poses serious downstream security risks

CyberScoop

A critical vulnerability has been identified in the Java security engine, specifically within the pac4j library, which is widely used for authentication and authorization in web applications. While researchers have not yet seen active exploitation of this flaw in real-world scenarios, the ease with which attackers could exploit it raises significant concerns. This vulnerability could impact a range of applications that rely on pac4j, potentially exposing sensitive user data and compromising security protocols. Developers and organizations using pac4j need to assess their systems and prepare for potential updates or patches to mitigate this risk.

Mar 10, 2026

FortiGate Devices Exploited to Breach Networks and Steal Service Account Credentials

The Hacker News

Cybersecurity researchers have reported a new trend where attackers are using FortiGate Next-Generation Firewall devices as gateways to infiltrate networks. These breaches are occurring through the exploitation of recently identified vulnerabilities or by taking advantage of weak passwords. Once inside, the attackers extract configuration files that contain sensitive service account credentials and details about the network's layout. This is concerning because it opens up pathways for further attacks within the affected networks. Organizations using FortiGate devices need to be aware of this threat and take immediate action to secure their systems.

Mar 10, 2026

APT28 conducts long-term espionage on Ukrainian forces using custom malware

Security Affairs

APT28, a Russian hacking group also known as Fancy Bear, has been conducting long-term espionage against Ukrainian military personnel using custom malware called BEARDSHELL and COVENANT. This campaign has been active since April 2024, allowing the attackers to maintain ongoing surveillance on military activities. ESET, the cybersecurity firm that reported on this incident, has highlighted the sophistication of the malware and the group's history of targeting government and military organizations. The implications of this espionage are significant, as it compromises the security and operational integrity of Ukrainian forces during a time of conflict. This incident showcases the persistent threat posed by state-sponsored cyber actors in geopolitical tensions.

Mar 10, 2026