2025-07-20 Daily Vulns
NEW: CVE vendor-product description metric Referenceurl title GithubURL CVE-2025-54309 CrushFTP - CrushFTP ...
ictsec.pl
2025-07-19 Daily Vulns
NEW: CVE vendor-product description metric Referenceurl title GithubURL CVE-2025-54309 CrushFTP - CrushFTP ...
2025-07-18 Daily Vulns
NEW: CVE vendor-product description metric Referenceurl title GithubURL CVE-2024-13972 Sophos - Sophos Interc...
The Linuxsys Cryptominer
Key Takeaways The Linuxsys cryptominer has been part of a long-running campaign exploiting multiple vulnerabilities with a consistent attacker methodology since at least 2021. The attacker levera...
NVIDIAScape - Critical NVIDIA AI Vulnerability A Three-Line Container Escape in NVIDIA Container Toolkit (CVE-2025-23266)
Wiz Research discovered a critical container escape vulnerability in the NVIDIA Container Toolkit (NCT), which we’ve dubbed #NVIDIAScape. This toolkit powers many AI services offered by cloud and S...
Mobile Forensics Tool Used by Chinese Law Enforcement Dissected
The application is believed to be the successor of MFSocket, a tool that was analyzed in 2019, and which was used by the country’s police for the same purposes. Both applications require physical ...
MaaS operation using Emmenhtal and Amadey linked to threats against Ukrainian entities
In April 2025, Cisco Talos identified a Malware-as-a-Service (MaaS) operation that utilized Amadey to deliver payloads. The MaaS operators used fake GitHub accounts to host payloads, tools and Amad...
GhostContainer backdoor malware compromising Exchange servers of high-value organizations in Asia
In a recent incident response (IR) case, we discovered highly customized malware targeting Exchange infrastructure within government environments. Analysis of detection logs and clues within the sa...
Flaw in Signal App Clone Could Leak Passwords — GreyNoise Identifies Active Reconnaissance and Exploit Attempts
A vulnerability disclosed in May 2025, CVE-2025-48927, affects certain deployments of TeleMessage™ SGNL, an enterprise messaging system modeled after Signal, used by government agencies and enterpr...
Fake Receipts Generators the rising threat to major retail brands
This report examines a growing scam technique involving fake receipt generators – tools that enable fraudsters to create counterfeit receipts from well-known brands. This research was brought to ou...
CryptoJacking is dead, long live CryptoJacking
It was 2017 when Coinhive burst onto the scene, embedding a Monero miner directly into websites. Users would unknowingly mine cryptocurrency while browsing, turning their devices into silent profit...
2025-07-17 Daily Vulns
NEW: CVE vendor-product description metric Referenceurl title GithubURL CVE-2025-30747 Oracle Corporation - P...
UNG0002, Regional Threat Operations Tracked Across Multiple Asian Jurisdictions
Key Findings Multi-Stage Attacks: UNG0002 employs sophisticated infection chains using malicious LNK files, VBScript, batch scripts, and PowerShell to deploy custom RAT implants including ...
Turbulence at Air Serbia, the latest airline under cyber siege
Aviation insiders say Serbia’s national airline, Air Serbia, was forced to delay issuing payslips to staff as a result of a cyberattack it is battling.\n\nInternal memos, seen by The Register, date...
Salt Typhoon breach Chinese APT compromises U.S. Army National Guard network
A DoD report warns that a China-nexus hacking group, Salt Typhoon, breached a U.S. state’s Army National Guard network from March to December 2024. The APT stole network configurations, admin crede...
Phish and Chips China-Aligned Espionage Actors Ramp Up Taiwan Semiconductor Industry Targeting
Key findings: Between March and June 2025, Proofpoint Threat Research observed three Chinese state-sponsored threat actors conduct targeted phishing campaigns against the Taiwanese semiconductor i...
Ongoing SonicWall Secure Mobile Access (SMA) Exploitation Campaign using the OVERSTEP Backdoor
Google Threat Intelligence Group (GTIG) has identified an ongoing campaign by a suspected financially-motivated threat actor we track as UNC6148, targeting fully patched end-of-life SonicWall Secur...
Old Miner, New Tricks H2miner Resurfaces with Lcrypt0rx Ransomware
The FortiCNAPP team, part of FortiGuard Labs, recently investigated a cluster of virtual private servers (VPS) used for Monero mining. The identified samples are associated with prior H2miner campa...
Global operation targets NoName057(16) pro-Russian cybercrime network
Between 14 and 17 July, a joint international operation, known as Eastwood and coordinated by Europol and Eurojust, targeted the cybercrime network NoName057(16). Law enforcement and judicial autho...
From a Teams Call to a Ransomware Threat Matanbuchus 3.0 MaaS Levels Up
In one of the most recent cases (July 2025), a Morphisec customer was targeted through external Microsoft Teams calls impersonating an IT helpdesk. During this engagement, Quick Assist was activate...