RDAP and BGP in Investigative Journalism
One of the things we’re most proud of at DomainTools is our Grants program. We offer free access and training to investigative journalists, as well as security researchers involved in community-ben...
ictsec.pl
Pay2Key’s Resurgence Iranian Cyber Warfare Targets the West
In the volatile aftermath of the Israel-Iran-USA conflict, a sophisticated cyber threat has re-emerged, targeting organizations across the West. Morphisec’s threat research team has uncovered the r...
Malicious pull request infects VS Code extension
In the last few months, Reversing Labs (RL) researchers have encountered multiple malicious packages that target cryptocurrency users and developers. In May, RL researcher Karlo Zanki wrote a blog ...
GoldMelody’s Hidden Chords Initial Access Broker In-Memory IIS Modules Revealed
Unit 42 researchers uncovered a campaign by an initial access broker (IAB) to exploit leaked Machine Keys — cryptographic keys used on ASP.NET sites — to gain access to targeted organizations. IABs...
From Click to Compromise Unveiling the Sophisticated Attack of DoNot APT Group on Southern European Government Entities
The DoNot APT group, also identified by various security vendors as APT-C-35, Mint Tempest, Origami Elephant, SECTOR02, and Viceroy Tiger, has been active since at least 2016, and has been attribut...
Combolists and ULP Files on the Dark Web A Secondary and Unreliable Source of Information about Compromises
Excerpt: “Combolists and URL-Login-Password (ULP) files have existed since the earliest user data leaks. These files offer a convenient format for storing and distributing compromised credentials ...
Animation-Driven Tapjacking on Android
TapTrap is a new type of attack targeting Android devices. It allows an app without any permissions to misuse screen animations. This app can secretly open another screen, such as a permission prom...
Anatsa Targets North America; Uses Proven Mobile Campaign Process
ThreatFabric researchers have identified a new campaign involving the Anatsa Android banking trojan, which is now targeting users in North America. This marks at least the third instance of Anatsa ...
2025-07-08 Daily Vulns
NEW: CVE vendor-product description metric Referenceurl title GithubURL CVE-2016-10033 n/a - n/a The ma...
NordDragonScan Quiet Data-Harvester on Windows
Affected Platforms: Microsoft Windows Impacted Users: Microsoft Windows Impact: The stolen information can be used for future attacks Severity Level: High FortiGuard Labs recently uncovered an act...
Hackers abuse leaked Shellter red team tool to deploy infostealers
Shellter Project, the vendor of a commercial AV/EDR evasion loader for penetration testing, confirmed that hackers used its Shellter Elite product in attacks after a customer leaked a copy of the s...
Digging Gold with a Spoon – Resurgence of Monero-mining Malware
Resurgence of Monero-mining Malware Is it the same XMRig threat from the past? What is apparent with the current XMRig threat is its multi-staged approach and use of LOLBAS (Living Off the Land B...
Deploying NetSupport RAT via WordPress & ClickFix
Source: Cybereason Excerpt: Delivery Mechanism Threat actors utilize phishing campaigns to distribute a malicious website link through: Phishing emails PDF attachments Gaming websites Att...
CVE-2025-5777 CitrixBleed 2 Write-Up… Maybe?
Technical Details We’ll skimp on a bunch of internal background information for NetScaler for the sake of brevity, but if you’re interested in reading further, here are a few good write-ups to get...
Batavia spyware steals data from Russian organizations
Since early March 2025, our systems have recorded an increase in detections of similar files with names like договор-2025-5.vbe, приложение.vbe, and dogovor.vbe (translation: contract, attachment) ...
BERT Ransomware Group Targets Asia and Europe on Multiple Platforms
Key Takeaways BERT (tracked by Trend Micro as Water Pombero) is a newly emerged ransomware group targeting both Windows and Linux platforms, with confirmed victims in Asia, Europe, and the US, par...
Critical vulnerabilities in NetScaler ADC exploited in-the-wild everything you need to know
On June 17th, 2025, two critical vulnerabilities - CVE-2025-5349 and CVE-2025-5777 - were disclosed in Citrix Netscaler ADC and Netscaler Gateway, enabling unauthorized access to sensitive resource...
Unmasking Insecure HTTP Data Leaks in Popular Chrome Extensions
Extensions analyzed expose information such as browsing domains, machine IDs, OS details, usage analytics, and more. Many users assume that popular Chrome extensions adhere to strong security prac...
Ingram Micro outage caused by SafePay ransomware attack
An ongoing outage at IT giant Ingram Micro is caused by a SafePay ransomware attack that led to the shutdown of internal systems, BleepingComputer has learned. Ingram Micro is one of the world’s l...
Phishing Attack Deploying Malware on Indian Defense BOSS Linux
Executive Summary CYFIRMA has identified a sophisticated cyber-espionage campaign orchestrated by APT36 (also known as Transparent Tribe), a threat actor based in Pakistan. This campaign specifical...