Hackers exploiting critical vulnerability in Windows Server Update Service

The vulnerability, tracked as CVE-2025-59287, involves deserialization of untrusted data and could allow intruders to execute code without authorization. Researchers at Huntress said they have seen...

Oct 25, 2025 SECURITY

Timestomping a PE compile timestamp - adversary tradecraft and detection

If you’ve wondered how advanced adversaries (red teams or real threat actors) try to blend into a target system or deceive CTI/IR analysts, this post shows how COFF timestomping (overwriting a PE’s...

Oct 23, 2025 INFORMATION SECURITY

IR Trends Q3 2025 ToolShell attacks dominate, highlighting criticality of segmentation and rapid response

Threat actors predominately exploited public-facing applications for initial access this quarter, with this tactic appearing in over 60 percent of Cisco Talos Incident Response (Talos IR) engagemen...

Oct 23, 2025 RESEARCH

Buying Spying - How the commercial surveillance industry works and what can be done about it

Google’s Threat Analysis Group (TAG) has released an in-depth report titled “Buying Spying,” detailing the inner workings of the commercial surveillance vendor (CSV) industry and its significant th...

Oct 23, 2025 RESEARCH

Anomali Cyber Watch - Nimbus Manticore, Spoofed IC3 Portals, a Record-Breaking DDoS Attack, and More

The Iranian APT group Nimbus Manticore is expanding its espionage activities into Western Europe, targeting defense, aerospace, and telecommunications organizations. Researchers have observed the g...

Oct 23, 2025 CYBERSECURITY

Agenda Ransomware Deploys Linux Variant on Windows Systems Through Remote Management Tools and BYOVD Techniques

Trend Research has identified a sophisticated Agenda ransomware attack, also known as Qilin, deploying a Linux-based ransomware binary on Windows systems, bypassing traditional Windows-centric secu...

Oct 23, 2025 MALWARE

TARmageddon Flaw in Popular Rust Library Leads to RCE

Tracked as CVE-2025-62518 (CVSS score of 8.1) and dubbed TARmageddon, the security defect is described as a desynchronization issue that occurs during the processing of nested TAR files with a spec...

Oct 22, 2025 SECURITY

SocGholish Malware Using Compromised Sites to Deliver Ransomware

This advanced threat, also known as FakeUpdates, is not just a single piece of malicious code; SocGholish operates as a sophisticated Malware-as-a-Service (MaaS) platform. This service allows affil...

Oct 22, 2025 MALWARE

Jaguar Land Rover hack cost UK economy an estimated $2.5 billion, report says

The hack of Jaguar Land Rover, owned by India’s Tata Motors, cost the British economy an estimated 1.9 billion pounds ($2.55 billion) and affected over 5,000 organisations, an independent cybersecu...

Oct 22, 2025 NEWS

Chinese Threat Actors Exploit ToolShell SharePoint Flaw Weeks After Microsoft's July Patch

Threat actors with ties to China exploited the ToolShell security vulnerability in Microsoft SharePoint to breach a telecommunications company in the Middle East after it was publicly disclosed and...

Oct 22, 2025 APT

2025-10-22 Daily Vulns

NEW: CVE vendor-product description metric Referenceurl title GithubURL CVE-2025-11534 Raisecomm - RAX701-GC-...

Oct 22, 2025 VULNERABILITIES

Vidar Stealer 2.0 adds multi-threaded data theft, better evasion

According to an announcement from the developer this month, Vidar 2.0 has been rewritten in C, supports multi-threading data stealing, bypasses Chrome’s app-bound encryption, and features more adva...

Oct 21, 2025 MALWARE

Threat Actors Leverage npm Ecosystem to Deliver AdaptixC2 Post-Exploitation Framework

This October, researchers uncovered its delivery through the npm package registry—a supply chain attack targeting developers and organizations reliant on Node.js modules for critical infrastructure...

Oct 21, 2025 CYBER SECURITY

TP-Link warns of critical command injection flaw in Omada gateways

TP-Link is warning of two command injection vulnerabilities in Omada gateway devices that could be exploited to execute arbitrary OS commands. Although the two security issues lead to the same resu...

Oct 21, 2025 SECURITY

Russian Coldriver Hackers Deploy New 'NoRobot' Malware

Instead, Coldriver seemed to have shifted to a new set of malware families tracked by Google as NoRobot, YesRobot and MaybeRobot. The attack starts with a ‘ClickFix-style’ phishing lure, a fake CAP...

Oct 21, 2025 APT

Ransomware Payouts Surge to $3.6m Amid Evolving Tactics

The average ransomware payment has increased to $3.6m this year, up from $2.5m in 2024 – a 44% surge despite a decline in the overall number of attacks. While the number of attacks dropped, the da...

Oct 21, 2025 RESEARCH

Hackers exploit 34 zero-days on first day of Pwn2Own Ireland

On the first day of Pwn2Own Ireland 2025, security researchers exploited 34 unique zero-days and collected 22,500 in cash awards. The highlight of the day was Bongeun Koo and Evangelos Daravigkas ...

Oct 21, 2025 SECURITY

China-Linked Salt Typhoon breaches European Telecom via Citrix exploit

The intrusion likely began with exploitation of a Citrix NetScaler Gateway appliance in the first week of July 2025. From there, the actor pivoted to Citrix Virtual Delivery Agent (VDA) hosts in th...