exploits

In brief: Microsoft fixes 3 zero-days, Russia-linked Star Blizzard cyber espionage campaign targets WhatsApp accounts, and more.  ​ Read More  ​ 

The threat actor took advantage of SPF records with an overly permissive configuration option, which allows any server to send emails on behalf of a domain.  ​ Read More  ​ 

Most of the cyberattacks targeting Ukraine over the past year were intended for espionage, financial theft, or to inflict psychological damage.  ​ Read More  ​ 

The attacks rely on AWS's Server-Side Encryption with Customer-Provided Keys (SSE-C) feature.  ​ Read More  ​ 

Nickle Tapestry orchestrated a scam on the IndieGoGo crowdfunding platform in 2016.  ​ Read More  ​ 

The brute-force attempts have resulted in account takeovers approximately 10% of the time.  ​ Read More  ​ 

The three zero-day flaws allow attackers to escalate their privileges to SYSTEM-level access.  ​ Read More  ​ 

The company said that it currently has no evidence of a data breach and that no backdoors were found on its systems.  ​ Read More  ​ 

The malware campaign has been attributed to a China-backed threat actor tracked as Mustang Panda or Twill Typhoon.  ​ Read More  ​ 

The campaign involves unauthorized admin access to the management interfaces of firewalls, creating new accounts, altering configurations, and exploiting VPN services.  ​ Read More  ​ 

The recent UAC-0063 campaign involves sophisticated spear-phishing attacks leveraging malware strains known as HATVIBE and CHERRYSPY.  ​ Read More  ​ 

The vulnerability allows attackers to escalate privileges and gain full control of cloud resources.  ​ Read More  ​ 

Several of the web shells had been backdoored by their original maintainers, leaking critical information.  ​ Read More  ​ 

The group accessed generative AI services and manipulated the system to produce harmful content.  ​ Read More  ​ 

Both mixers were allegedly used by criminals to launder funds tied to theft, ransomware, and other cybercrimes.  ​ Read More  ​