Ports are getting smarter and more hackable
A new policy brief from NATO’s Cooperative Cyber Defence Centre of Excellence (CCDCOE) warns that critical port infrastructure, responsible for 80 percent of global trade, is increasingly under att...
ictsec.pl
Operation CargoTalon UNG0901 Targets Russian Aerospace & Defense Sector using EAGLET implant.
Introduction SEQRITE Labs APT-Team has recently found a campaign targeting the Russian Aerospace Industry. The campaign aims at employees of Voronezh Aircraft Production Association (VASO), a sign...
Key figure behind major Russian-speaking cybercrime forum targeted in Ukraine
A long-running investigation led by the French Police and Paris Prosecutor, in close cooperation with their Ukrainian counterpart and Europol, has led to the arrest of the suspected administrator o...
Illusory Wishes China-nexus APT Targets the Tibetan Community
Key Takeaways ThreatLabz observed targeted malware intrusions that employed social engineering tactics, leveraging the Dalai Lama’s 90th birthday through strategic web compromises to lure Tibetan c...
HAFNIUM-Linked Hacker Xu Zewei Riding the Tides of China’s Cyber Ecosystem
On July 3, 2025, at Milan Malpensa Airport, Italian police arrested Xu Zewei (徐泽伟), whom U.S. authorities allege to be a hacker contracted by the Chinese state. Following the news about Xu’s arrest...
Gunra Ransomware Emerges with New DLS
During the first half of 2025, many ransomware groups have been actively opening new Dedicated Leak Sites (DLS). The following graph shows new ransomware DLS sites identified by AhnLab from Februar...
Dropping Elephant APT Group Targets Turkish Defense Industry With New Campaign and Capabilities LOLBAS, VLC Player, and Encrypted Shellcode
Source: Arctic Wolf Executive Summary The Arctic Wolf® Labs team has identified a new campaign by cyber-espionage group Dropping Elephant targeting Turkish defense contractors, specifically a manu...
Critical Vulnerabilities Found in Tridium Niagara Framework
Tridium’s Niagara Framework® is a leading software framework designed to connect, manage, and control diverse devices in building management, industrial automation, and smart infrastructure environ...
Account Takeover Vulnerability Affecting Over 400K Installations Patched in Post SMTP Plugin
The security vulnerability in versions 3.2.0 and below of the Post SMTP plugin is associated with multiple Broken Access Control vulnerabilities in its REST API endpoints. These endpoints only val...
A Special Mission to Nowhere, Exploiting the Middle East crisis with a charter jet scam
On June 13, 2025, Israel launched a sweeping pre-emptive operation targeting Iran’s military leadership, conventional military sites, air defenses, and nuclear infrastructure. The campaign was dubb...
2025-07-23 Daily Vulns
NEW: CVE vendor-product description metric Referenceurl title GithubURL CVE-2012-10020 WebMovementLLC - FoxyP...
The Rise of Acreed Infostealer in the Post-LummaC2 Threat Landscape
Acreed, a new malware-as-a-service (MaaS) platform, appears to have taken the top spot in the infostealer ecosystem. We suspect this is due to the takedown of Lumma Stealer (LummaC2) in May 2025. I...
Ransomware Group Uses AI Chatbot to Intensify Pressure on Victims
A threat actor claiming to have launched a new ransomware-as-a-service (RaaS) venture is leveraging AI chatbots in its negotiation panel to automate communication and apply psychological pressure o...
How We Accidentally Discovered a Remote Code Execution Vulnerability in ETQ Reliance
It seems that vulnerability research is becoming increasingly challenging every year, as frameworks and languages become more secure by default and vendors are more aware of the security risks that...
How DEF CON hacking villages help to save the planet
If you haven’t yet listened to RunSafe Security’s excellent podcast, EXPLOITED: THE CYBER TRUTH, here’s a great place to start. In this episode, Hiding Vulns Sinks All Ships, special guest Duncan ...
Coyote in the Wild First-Ever Malware That Abuses UI Automation
Executive summary Akamai researchers previously outlined the potential for malicious use of UI automation (UIA). Now, Akamai researchers have analyzed a new variant of the Coyote malware that is t...
Clickfix on macOS AppleScript Malware Campaign Uses Terminal Prompts to Steal Data
Key Takeaways Clickfix abuses trust: The campaign bypasses malware downloads by using fake security prompts to trick users into running terminal commands. AppleScript payloads steal user data: The ...
Back to Business Lumma Stealer Returns with Stealthier Methods
Key takeaways Not long after its takedown in May, Lumma Stealer is back. From June to July, the number of targeted accounts began resurging. Now, the malware is distributed with more discreet chan...
BIDI Swap Unmasking the Art of URL Misleading with Bidirectional Text Tricks
Varonis Threat Labs is shining a spotlight on a decade-old vulnerability that opens the door to URL spoofing. By exploiting how browsers handle Right-to-Left (RTL) and Left-to-Right (LTR) scripts,...
2025-07-22 Daily Vulns
NEW: CVE vendor-product description metric Referenceurl title GithubURL CVE-2025-30746 Oracle Corporation - O...