CISA Warns of Sitecore RCE Flaws; Active Exploits Hit Next.js and DrayTek Devices
CISA added two six-year-old security flaws impacting Sitecore CMS and Experience Platform (XP) to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation, along with active exploits hitting Next.js and DrayTek devices.
Read More
Qilin affiliates spear-phish MSP ScreenConnect admin, targeting customers downstream
Qilin ransomware affiliates are targeting customers downstream after spear-phishing a MSP ScreenConnect admin, continuing a three-year pattern tracked by Sophos MDR as STAC4365.
Read More
Ransomware Group Takes Credit for National Presto Industries Attack
A ransomware group has claimed responsibility for a March cyberattack on National Presto Industries subsidiary National Defense Corporation.
Read More
New Malware Variant RESURGE Exploits Ivanti Vulnerability
CISA recommends immediate action to address malware variant RESURGE exploiting Ivanti vulnerability CVE-2025-0282.
Read More
Phishing platform 'Lucid' behind wave of iOS, Android SMS attacks
A phishing-as-a-service (PhaaS) platform named 'Lucid' has been targeting 169 entities in 88 countries using well-crafted messages sent on iMessage (iOS) and RCS (Android).
Read More
Hackers abuse WordPress MU-Plugins to hide malicious code
Hackers are utilizing the WordPress mu-plugins ("Must-Use Plugins") directory to stealthily run malicious code on every page while evading detection.
Read More
BlackLock Ransomware Exposed After Researchers Exploit Leak Site Vulnerability
In what's an instance of hacking the hackers, threat hunters have managed to infiltrate the online infrastructure associated with a ransomware group called BlackLock, uncovering crucial information about their modus operandi in the process. Resecurity said it identified a security vulnerability in the ransomware group's leak site, which it then weaponized to gain unauthorized access to their internal systems.
Read More
Hackers Repurpose RansomHub's EDRKillShifter in Medusa, BianLian, and Play Attacks
A new analysis has uncovered connections between affiliates of RansomHub and other ransomware groups like Medusa, BianLian, and Play. The connection stems from the use of a custom tool that's designed to disable endpoint detection and response (EDR) software on compromised hosts, according to ESET.
Read More
New Android Trojan Crocodilus Abuses Accessibility to Steal Banking and Crypto Credentials
Cybersecurity researchers have discovered a new Android banking malware called Crocodilus that's primarily designed to target users in Spain and Turkey. "Crocodilus enters the scene not as a simple clone, but as a fully-fledged threat from the outset, equipped with modern techniques such as remote control and overlay attacks,"
Read More
EncryptHub Exploits Windows Zero-Day to Deploy Rhadamanthys and StealC Malware
The threat actor known as EncryptHub exploited a recently-patched security vulnerability in Microsoft Windows as a zero-day to deliver a wide range of malware families, including backdoors and information stealers such as Rhadamanthys and StealC. "In this attack, the threat actor manipulates .msc files to deliver and execute a malicious payload,"
Read More
APT36 Spoofs India Post Website to Infect Windows and Android Users with Malware
An advanced persistent threat (APT) group with ties to Pakistan has been attributed to the creation of a fake website masquerading as India's public sector postal system as part of a campaign designed to infect both Windows and Android users in the country. Cybersecurity company CYFIRMA has attributed the activity to APT36 (aka Earth Karkaddan, Mythic Leopard, and Transparent Tribe), citing overlaps in tactics, techniques, and procedures (TTPs).
Read More
PJobRAT Malware Campaign Targeted Taiwanese Users via Fake Chat Apps
An Android malware family previously observed targeting Indian military personnel has been linked to a new campaign likely aimed at users in Taiwan under the guise of chat apps. "PJobRAT can steal SMS messages, phone contacts, device and app information, documents, and media files from infected Android devices,"
Read More