Critical

Attackers Say 'Hello' to a Different Scale of Cloud Attack

darkreading
Actively Exploited

Overview

Researchers have identified a new attack chain named 'Greeter', where attackers cleverly masked their activities by embedding 'hello' messages in system logs. This tactic not only obscures their presence but also complicates the forensic analysis of any breaches. The specific targets of these attacks have not been detailed, but the implications are significant for organizations relying on cloud infrastructure. By learning how attackers operate and how they attempt to cover their tracks, companies can better prepare their defenses and enhance their monitoring practices. Understanding such methods is crucial as cyber threats continue to evolve and become more sophisticated.

Key Takeaways

  • Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
  • Action Required: Organizations should enhance their log monitoring and forensic analysis capabilities to detect similar tactics.
  • Timeline: Newly disclosed

Original Article Summary

Researchers dubbed an attack chain "Greeter" after discovering that attackers deliberately covered their trail by leaving "hello" messages in logs.

Impact

Not specified

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Organizations should enhance their log monitoring and forensic analysis capabilities to detect similar tactics. Regularly review and audit logs for unusual entries and behaviors.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Coverage

Critical Pre-Auth MongoDB Flaw (CVE-2026-118383) Can Crash Lagging Servers on Failover

The Hacker News

A serious vulnerability has been discovered in MongoDB Server, identified as CVE-2026-118383. This flaw allows attackers to send two specific requests that can cause the database server to crash. The issue arises particularly when a server, which is lagging behind in updates, is promoted to the main server role. MongoDB has responded quickly, releasing fixed versions to address this vulnerability. It's crucial for users of MongoDB to apply these updates to prevent potential disruptions in their database operations, especially in environments that rely on server failover for continuity.

Nov 12, 2026

Node.js Fixes 16 Flaws, Including HTTP/2 Bugs That Crash Servers and Leak Other Connections' Data

The Hacker News

Node.js has patched 16 vulnerabilities, including critical flaws in its HTTP/2 support that could allow unauthenticated users to crash servers running versions 24.x and 26.x. One vulnerability could lead to a denial-of-service attack, while another could expose sensitive data by sending memory contents from the server to clients, potentially revealing information meant for other connections. The fixed versions are 22.23.5, 24.22.3, and 26.13.1. It’s crucial for developers and organizations using Node.js to update their systems to these latest versions to protect against these issues and ensure server stability and data security.

Nov 12, 2026

Attacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer in 1,806+ Repositories

The Hacker News

An attacker has exploited stolen credentials from 4,837 GitHub accounts to deploy a secret stealer in over 1,800 repositories. This malicious code is designed to extract sensitive information, including secrets and cloud credentials, from the continuous integration (CI) workflows associated with these repositories. The incident, reported by Aikido Security, raises significant concerns for developers and organizations that rely on GitHub for version control and collaboration. If attackers successfully collect these secrets, they could gain unauthorized access to critical systems and data. This incident underscores the need for users to strengthen their account security and monitor their repositories closely.

Nov 12, 2026

Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely

The Hacker News

A serious vulnerability has been discovered in the Apache HTTP Server's HTTP/2 module, known as mod_http2. This flaw, cataloged as CVE-2026-119618, allows remote attackers to execute code on servers running versions 2.4.55 through 2.4.70, provided that HTTP/2 is enabled. The vulnerability was addressed with the release of version 2.4.71, which became available just yesterday. Red Hat, which distributes Apache as part of Red Hat Enterprise Linux, has confirmed that only servers with HTTP/2 enabled are at risk. This vulnerability is particularly concerning as it could allow unauthorized access and control over server operations, making timely updates crucial for affected users.

Nov 12, 2026

ScreenConnect Attacks Target at Least 288 Endpoints Across 48 Organizations With Rogue Clients

The Hacker News

ConnectWise has disabled five third-party extensions used with its ScreenConnect software after discovering unauthorized access affecting at least 288 endpoints across 48 organizations. The company reassured users that there is no evidence of a breach in its own infrastructure or any vulnerabilities in the ScreenConnect software itself. The incident appears to involve rogue clients exploiting these extensions. This situation raises concerns about the security of third-party tools connected to major software platforms, as they can introduce risks even when the primary software remains secure. Organizations using these extensions should review their security practices and consider additional safeguards to protect against similar incidents.

Nov 12, 2026

Chinese AI Project Scouts Spies in Taiwan Chip Industry

darkreading

A new report reveals that the Chinese Communist Party (CCP) has developed a Big Data system aimed at gathering extensive information about individuals in Taiwan's semiconductor industry. This initiative appears to target key figures in the chip sector, potentially for espionage or other exploitative purposes. By collecting vast amounts of personal data, the CCP seeks to identify and manipulate individuals who could be of strategic interest. This situation raises significant concerns about the security of sensitive technologies and the integrity of supply chains, especially in a region critical to global tech infrastructure. The implications for Taiwan's chip manufacturers and their international partners are profound, as they may face increased risks of infiltration and manipulation.

Nov 12, 2026