Critical

Silver Fox group uses new drivers in BYOVD attacks against Japanese manufacturer

SCM feed for Latest

July 30, 2026 at 11:35 PM

Actively Exploited

Overview

The Silver Fox group has been targeting a Japanese manufacturer using a method known as Bring Your Own Vulnerable Driver (BYOVD). The attack starts with a phishing email disguised as an invoice, which directs victims to content hosted on legitimate services like QQ and Tencent Cloud. This tactic allows the attackers to bypass security measures and gain access to the victim's systems. Such incidents are concerning as they exploit trusted platforms, making it harder for organizations to defend against these types of attacks. Companies need to be vigilant about phishing threats and ensure their employees are trained to recognize suspicious communications.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: Japanese manufacturer's systems, QQ and Tencent Cloud services
Action Required: Users should be cautious with email attachments and links, especially from unknown sources.
Timeline: Newly disclosed

Original Article Summary

The attack chain begins with a phishing lure disguised as an invoice, utilizing attacker-controlled content hosted on legitimate QQ and Tencent Cloud services.

Impact

Japanese manufacturer's systems, QQ and Tencent Cloud services

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Users should be cautious with email attachments and links, especially from unknown sources. Implementing robust email filtering and user training can help mitigate risks.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Phishing, Exploit.

Read Original Article

Related Coverage

Arrested man allegedly impersonated NSA elite hacking unit, Supreme Court chief justice

CyberScoop

Joshua Culver, also known as 'Maverick Young,' has been arrested for allegedly impersonating a high-ranking official from the NSA's Tailored Access Operations unit, which is known for its elite hacking capabilities. This incident reportedly took place during a period when the unit was not publicly referred to by that name, raising concerns about the potential for misuse of sensitive information and authority. Culver is also accused of impersonating the Chief Justice of the Supreme Court. This type of impersonation can have serious implications for national security and the integrity of government institutions, as it can undermine trust in official communications. Law enforcement continues to investigate the full extent of Culver's actions and any potential victims affected by his impersonations.

Aug 25, 2026

CISA adds Oracle WebLogic bug to its list of exploited vulnerabilities

SCM feed for Latest

The Cybersecurity and Infrastructure Security Agency (CISA) has added a newly identified vulnerability in Oracle WebLogic to its list of actively exploited security issues. This vulnerability allows attackers to gain access to core business applications within an enterprise, posing significant risks to sensitive data and operations. Organizations using Oracle WebLogic middleware need to be particularly vigilant, as this exploitation could lead to severe disruptions and data breaches. Experts recommend that affected companies prioritize patching this vulnerability to safeguard their systems. The urgency is underscored by the fact that attackers are actively exploiting this flaw.

Aug 25, 2026

Norway ’s Digital Government Infrastructure Hit by a new DDoS Attack

Security Affairs

Norway's shared government digital infrastructure faced its third distributed denial-of-service (DDoS) attack on August 24, 2023, starting at 03:38 CEST. This attack disrupted various online services that citizens, businesses, and public agencies rely on. Fortunately, officials reported no indications of data breaches or compromise during the incident. The repeated nature of these attacks raises concerns about the resilience of Norway's digital systems and their ability to withstand ongoing cyber threats. This incident highlights the need for stronger cybersecurity measures to protect essential public services.

Aug 25, 2026

Water sector passes, government sector fails attempts to spot and halt simulated CISA attack

CyberScoop

In a recent cybersecurity test, red-teamers conducted simulated attacks on both the water and government sectors to evaluate their response capabilities. The water sector successfully identified and contained the simulated threats, effectively preventing any further access. In contrast, the government sector failed to manage the attack, allowing the red-teamers to gain initial access without detection. This incident illustrates the varying levels of preparedness among critical infrastructure sectors and raises concerns about the government's ability to secure sensitive systems against potential real-world attacks. The implications of such failures could be significant, especially given the importance of both sectors in maintaining public safety and national security.

Aug 25, 2026

When the Algorithm Fires You: Uber Faces €825M Fine

Security Affairs

Uber is facing a hefty €825 million fine from the Dutch Data Protection Authority for suspending drivers' accounts without human oversight. This fine is the largest Uber has received under GDPR regulations and is significant because it raises concerns about the use of automated decision-making in employment practices. The ruling emphasizes that companies should ensure that any actions affecting workers are reviewed by humans rather than relying solely on algorithms. This incident not only impacts Uber and its drivers but also sets a precedent for how other companies might handle similar situations in the future. As AI continues to play a larger role in business operations, the necessity for accountability and transparency in automated systems is becoming increasingly critical.

Aug 25, 2026

Massive DDoS attack disrupts Norway’s government digital services

BleepingComputer

Norway's government digital services have been disrupted by a significant distributed denial-of-service (DDoS) attack that began on Monday. The attack has targeted the country's shared digital infrastructure, impacting various services utilized by public sector entities. As a result, users may experience difficulties accessing important government resources and services. This incident raises concerns about the security and reliability of government digital platforms, particularly in the face of increasing cyber threats. Authorities are working to mitigate the effects of the attack and restore normal operations as soon as possible.

Aug 25, 2026