VulnHub

A new strain of ransomware known as Osiris has been identified, targeting a major food service franchisee operator in Southeast Asia in November 2025. The attackers utilized a malicious driver called POORTRY in a technique known as bring your own vulnerable driver (BYOVD), which helps them disable security measures on the victim's systems. This method allows the ransomware to operate without detection, increasing the risk of data theft and operational disruption. The emergence of Osiris is concerning as it reflects a growing trend in ransomware attacks that exploit existing drivers to bypass security protocols. Organizations, especially those in sensitive sectors like food services, need to be vigilant and ensure their security measures can defend against such sophisticated techniques.

Cisco has addressed a serious security flaw in its Unified Communications and Webex Calling platforms, identified as CVE-2026-20045. This vulnerability allows attackers to execute arbitrary commands remotely without authentication, posing a significant risk to users. The flaw has been actively exploited in the wild, which raises concerns for organizations relying on these communication tools. With a CVSS score of 8.2, it is classified as critical, emphasizing the urgency for users to apply the available patches. Companies utilizing Cisco's services should prioritize updating their systems to mitigate potential attacks.

Hackers are taking advantage of poorly configured web applications that are designed for security training and testing, such as DVWA, OWASP Juice Shop, Hackazon, and bWAPP. These applications are being used as gateways to access the cloud environments of various Fortune 500 companies and security vendors. The attackers exploit these misconfigurations to infiltrate systems that should ideally serve as safe environments for testing security measures. This situation raises serious concerns for companies that rely on these tools for internal security practices, as it exposes them to potential data breaches and unauthorized access. Organizations need to ensure that their security testing applications are correctly configured to prevent exploitation by malicious actors.

North Korean hackers are targeting macOS developers by luring them to malicious projects on GitHub and GitLab that are opened with Visual Studio Code. The attackers use these repositories to trick users into executing harmful code, potentially compromising their systems. This tactic poses a significant risk to developers who may unknowingly download and run these malicious projects, which could lead to data breaches or further exploitation of their systems. As these attacks exploit popular development tools, developers need to be vigilant about the sources of the projects they access. This incident emphasizes the ongoing threat posed by state-sponsored hackers and the need for heightened awareness in the software development community.

A new information-stealing malware called 'SolyxImmortal' has emerged, which utilizes legitimate APIs and libraries to gather sensitive data. The malware sends this stolen information to Discord webhooks, making detection challenging. This type of attack can affect anyone who unwittingly downloads the malware, potentially compromising personal and financial information. As cybercriminals increasingly exploit trusted platforms and tools, users need to be vigilant about the software they install and the permissions they grant. This incident serves as a reminder of the evolving tactics used by attackers to bypass security measures.

CyberArk has reported that it successfully exploited a vulnerability in the StealC infostealer malware to gather intelligence. This malware is known for stealing sensitive information from infected systems, which can include login credentials, financial data, and personal information. By exploiting the flaw, researchers were able to collect evidence that can help understand how the malware operates and how it might be mitigated. This incident underscores the ongoing challenges posed by infostealers and the need for organizations to remain vigilant against such threats. Users and companies should ensure their systems are updated and monitor for signs of compromise, as infostealers like StealC can have serious implications for data security.

A recent report from Infosecurity Magazine indicates that industrial technology environments are facing a significant surge in cyberattacks. The number of incidents has doubled, particularly targeting vulnerabilities in industrial control systems. This increase poses serious risks for industries reliant on these systems, as attackers may exploit weaknesses to disrupt operations or compromise sensitive data. Companies operating in sectors such as manufacturing, energy, and transportation should be particularly vigilant, as the implications of these attacks could lead to operational downtime and financial losses. The trend highlights the urgency for organizations to enhance their cybersecurity measures to protect against evolving threats.

Researchers discovered a cross-site scripting (XSS) vulnerability in the web-based control panel of the StealC info-stealing malware. This flaw allowed them to monitor the malware operators' active sessions and collect data on their hardware setups. StealC is designed to steal sensitive information from users, which means this incident not only exposes the attackers but also raises concerns about the ongoing effectiveness of such malware. Understanding these vulnerabilities can help cybersecurity experts develop better defenses against similar threats. The incident serves as a reminder that even sophisticated malware can have weaknesses that researchers can exploit to gain insights into cybercriminal operations.