North Korean hackers are targeting Ukrainians with phishing attacks aimed at gathering intelligence related to the ongoing war. These attacks involve simple tactics, such as baiting individuals into replying to emails that appear legitimate. The goal is to extract valuable information about Ukraine's military efforts and strategies. This development is concerning as it not only highlights the ongoing cyber warfare but also shows how nation-states are leveraging cyber tactics to further their military objectives. The implications of such attacks could impact the security and operational effectiveness of Ukrainian forces, making it crucial for individuals and organizations to remain vigilant against these types of phishing attempts.
Cybercriminals are increasingly targeting employees within organizations to gain legitimate access to sensitive systems and data. A recent report from Intel 471 reveals a troubling trend where criminals are recruiting insiders to perform routine tasks like account resets and transaction approvals for illicit purposes. These insiders can be found through brokers who are paid to identify suitable candidates at specific companies. The report suggests that this insider access can help criminals bypass traditional security measures, making it easier for them to conduct fraud or data theft. This trend poses significant risks to organizations, as it can lead to severe breaches and financial losses.
The latest Security Affairs Malware newsletter covers significant developments in the malware landscape, including a case where a Malware-as-a-Service platform exploited GitHub to distribute malicious software across forty different companies. One notable threat discussed is the PAYLOAD ransomware, which has been found to weaponize Active Directory Group Policy Objects (GPO), making it easier for attackers to infiltrate and control networks. Additionally, researchers are tracing a Node.js Remote Access Trojan (RAT) named ChainScript, which is being used in various cyber attacks. These incidents highlight the evolving tactics of cybercriminals and the need for organizations to stay vigilant against sophisticated malware techniques that can compromise their systems and sensitive data.
Researchers have identified a new hardware attack named DDRop that compromises memory protection in Intel and AMD's confidential computing systems. This attack allows an unauthorized user, who already has control over the server's software, to manipulate memory writes. By inserting a small circuit, the attacker can cause the processor to read outdated encrypted data as if it were current. This vulnerability poses significant risks for organizations relying on Intel TDX and AMD SEV-SNP technologies for secure computing, as it undermines the confidentiality of sensitive data. Companies using these systems should be aware of the potential for exploitation and take action to secure their environments.
Tycon Systems has identified several vulnerabilities in its TPDIN-Monitor-WEB3 device, affecting versions 2.2.9 and earlier. These vulnerabilities could allow attackers to conduct man-in-the-middle attacks, perform factory resets, or access sensitive information due to hard-coded credentials, cross-site request forgery (CSRF), and missing authorization. The CVEs associated with these issues are CVE-2026-77847, CVE-2026-82712, and CVE-2026-82684, with severity ratings ranging from medium to high. Tycon Systems has released a firmware update, version 2.4.2, which addresses these vulnerabilities. Users still operating on the older version are urged to upgrade promptly to enhance their security posture and protect against potential exploits.
Attackers are increasingly purchasing expired domain names to take advantage of their established online reputation and traffic. These domains, referred to as dropcatch domains, can be exploited for malicious purposes, including distributing malware, conducting scams, and setting up command-and-control (C2) infrastructure. Each day, around 65,000 domain names that have lapsed are re-registered by new owners, which presents a significant risk. This trend poses dangers to users and organizations as they may unwittingly interact with these compromised domains, leading to potential security breaches. Awareness of this tactic is crucial for internet users and companies to mitigate risks associated with these expired domains.
Intel has announced the discovery of several high-severity vulnerabilities that could allow attackers to escalate privileges and execute arbitrary code on affected systems. The vulnerabilities affect a range of Intel products, posing significant risks to users and organizations relying on these technologies. In total, both Intel and AMD have fixed over 80 vulnerabilities combined, indicating a widespread issue within the chipmaking industry. Users are urged to apply the latest patches to safeguard their systems against potential exploitation. This situation underscores the need for continuous vigilance and prompt action in maintaining cybersecurity.
Senator Tom Cotton, chair of the Senate Intelligence Committee, has reached out to Treasury Secretary Scott Bessent to advocate for tax code changes aimed at modernizing operational technology (OT). The proposed adjustments are intended to encourage investment in outdated technology, which is crucial for improving defenses against cyberattacks. Cotton's initiative comes in light of increasing vulnerabilities in critical infrastructure that rely on older systems. By making these tax modifications, the senator hopes to bolster security measures and reduce the risk of future cyber incidents that could impact essential services. This effort highlights the ongoing need for government and private sector collaboration to protect vital infrastructure from evolving cyber threats.
The House Intelligence Committee has advanced its fiscal 2027 authorization bill, which includes significant provisions aimed at enhancing state and local threat intelligence and improving election security. This legislation acknowledges the growing risks posed by cyber threats, particularly as they relate to elections and the use of artificial intelligence. By focusing on state and local levels, the bill seeks to bolster resources and support for agencies that are often on the front lines of cybersecurity. The implications of this bill are important, as it aims to create a more coordinated response to potential threats and ensure that local governments have the necessary tools to protect their systems and data. The advancements in election security are particularly timely, given the ongoing concerns about election integrity in the digital age.
A serious vulnerability in the Linux Kernel-based Virtual Machine (KVM) has been discovered, allowing attackers to potentially escape from a virtual machine (VM) to the host system. This flaw, which is 16 years old, affects both Intel and AMD systems. Security researcher Hyunwoo Kim reported that the issue is a use-after-free vulnerability, enabling malicious code running in a guest VM to corrupt the memory of the host kernel. The implications are significant, as it could allow unauthorized access to sensitive data or control over the host. Organizations using affected systems should take immediate action to assess their vulnerability and apply necessary patches to safeguard their environments.
A vulnerability in the Linux KVM hypervisor has been discovered, allowing guest virtual machines (VMs) to escape and potentially compromise the host system. This flaw, identified as CVE-2026-53359 and nicknamed 'Januscape,' arises from a use-after-free bug within the shadow MMU code that is utilized by both Intel and AMD x86 architectures. Researchers have demonstrated a proof-of-concept that can crash the host machine, raising concerns about the security of virtualized environments. The existence of an unreleased exploit that could further exploit this vulnerability has also been claimed, suggesting that the risk is significant. Organizations using Linux KVM on affected systems should take immediate precautions to secure their environments.
A recent warning from the intelligence agencies of the Five Eyes alliance—comprising Australia, Canada, New Zealand, the United Kingdom, and the United States—indicates that advanced AI models are set to transform the field of cybersecurity at an accelerated pace. Experts believe that these frontier AI technologies could change how cybersecurity threats are identified and mitigated. The rapid evolution of AI capabilities may outstrip current defenses, making organizations more vulnerable to attacks. This shift is concerning for businesses and individuals alike, as it could lead to more sophisticated cyber threats that are harder to detect and counter. Stakeholders in cybersecurity need to adapt quickly to these changes to protect sensitive information effectively.
A new threat group, referred to as Operation Escaneo, has emerged in Latin America, displaying a unique approach to cyberattacks. This group appears to blend opportunistic monetization with intelligence gathering, often without coordinated efforts between the two activities. This dual focus raises concerns about the potential for more disruptive attacks, as the group may exploit vulnerabilities for financial gain while simultaneously collecting valuable information. The implications of this strategy could affect various sectors in the region, particularly as attackers may target organizations without prior notice. Companies need to be vigilant and enhance their cybersecurity measures to defend against such evolving threats.
Google's threat intelligence team has identified a new extortion group known as UNC6783, which appears to be linked to the Raccoon persona. This group is specifically targeting Business Process Outsourcing (BPO) companies and helpdesk services, indicating a shift in focus towards sectors that handle sensitive customer data. The group's tactics may involve ransomware or other extortion methods, which poses significant risks to affected organizations. Companies in the BPO sector should be vigilant and enhance their security measures to protect against potential breaches and data leaks. As this threat evolves, understanding the methods and motivations behind it will be crucial for businesses in these industries.
Hackread – Cybersecurity News, Data Breaches, AI and More
Actively Exploited
Dutch intelligence agencies have issued a warning about Russian hackers who are targeting Signal and WhatsApp accounts. These attackers are using fake support bots and scams that trick users into providing verification codes. The primary targets of these scams are officials and journalists, raising concerns about the potential for unauthorized access to sensitive communications. This incident highlights the ongoing risks posed by cybercriminals and the need for users to be vigilant when managing their online accounts. As these platforms are commonly used for secure communication, any compromise could have serious implications for privacy and security.