Home > Directory > Sicurezza > SecureBulletin
SecureBulletin EN
Cybersecurity news in English · visibilità: nel misto della home, non in primo piano.
Sito originale · Feed RSS della fonte
1.243 voci in archivio · mostrate 901–925 .
Oniux: Kernel-Level Tor isolation for Linux applications
The Tor Project has unveiled oniux, a new command-line utility designed to deliver robust, kernel-enforced Tor isolation for any Linux application-a significant advancement in the ongoing quest for airtight traffic anonymity and leak preven…
Coinbase faces major Data Breach: $400 Million in potential losses
Coinbase, one of the world’s largest cryptocurrency exchanges with over 100 million customers, has disclosed a significant data breach orchestrated through insider collusion. The attack, which came to light following a ransom demand on May…
Katz Stealer: infostealers targets 78+ Chromium and Gecko-based browsers
A newly uncovered information stealer, dubbed Katz Stealer, has rapidly emerged as a formidable threat to both enterprise and individual users by targeting an unprecedented range of over 78 Chromium and Gecko-based browsers. Written in C an…
Trojanized KeePass campaign: novel loader and credential theft in ransomware operations
A recent investigation by WithSecure’s Threat Intelligence team has uncovered a sophisticated malware campaign leveraging a trojanized version of the open-source password manager KeePass. This operation, active for at least eight months, ma…
China-Linked APTs exploit critical SAP NetWeaver vulnerability to breach over 580 systems globally
In a significant escalation of cyber-espionage activities, multiple China-affiliated advanced persistent threat (APT) groups have been found actively exploiting a recently disclosed critical vulnerability in SAP NetWeaver, identified as CVE…
JPEG image FUD ransomware: a way to evades antivirus solutions
In a concerning development for cybersecurity professionals, threat actors have begun leveraging a novel Fully UnDetectable (FUD) ransomware attack technique that utilizes seemingly benign JPEG image files as the initial infection vector. T…
New malware LOSTKEYS uncovered in COLDRIVER campaign targeting Western governments and NGOs
The Google Threat Intelligence Group (GTIG) has recently uncovered a sophisticated new malware strain, dubbed LOSTKEYS, deployed by the Russian state-sponsored threat actor COLDRIVER (also known as UNC4057, Star Blizzard, or Callisto). This…
German authorities shut down major crypto-swapping platform “eXch,” seizing €34 million in illicit assets
On April 30, 2025, the Frankfurt am Main General Prosecutor’s Office-Central Unit for Combating Internet Crime (ZIT)-in close collaboration with the German Federal Criminal Police Office (BKA), executed a decisive operation to dismantle the…
Tactical reality behind the India-Pakistan hacktivist surge
In May 2025, a wave of hacktivist activity targeting Indian digital infrastructure sparked widespread alarm in media and social networks, with numerous groups claiming significant breaches of government, educational, and critical infrastruc…
From PDF invoice to geo-fenced RAT delivery campaign
A recent campaign targeting Southern European organizations demonstrates advanced evasion techniques combining social engineering, trusted platforms, and geolocation filtering. The attack chain unfolds through four precision stages: 1. Legi…
Emerging DOGE Big Balls ransomware campaign leverages multi-stage tooling and BYOVD exploits
A recent analysis of newly discovered payloads linked to the DOGE Big Balls ransomware operation reveals a complex infection chain combining open-source tools, kernel-level exploits, and psychological warfare. This variant of the Fog ransom…
Malicious npm packages hijack macOS Cursor AI IDE
The Socket Threat Research Team has uncovered a sophisticated supply chain attack targeting macOS developers using the Cursor AI code editor. Three malicious npm packages-sw-cur, sw-cur1, and aiide-cur-have been identified as backdoors that…
Stealthy Linux backdoor leveraging residential proxies and NHAS reverse SSH
A recently discovered Linux backdoor (SHA256: ea41b2bf1064efcb6196bb79b40c5158fc339a36a3d3ddee68c822d797895b4e) employs advanced evasion techniques to bypass detection while establishing persistent access via SOCKS5 proxies and in-memory pa…
US indicts Black Kingdom ransomware operator: technical analysis of ProxyLogon exploitation and law enforcement response
The U.S. Department of Justice unsealed charges against Yemeni national Rami Khaled Ahmed (36) for deploying Black Kingdom ransomware via ProxyLogon exploits (CVE-2021-26855) against 1,500+ systems, including U.S. healthcare, education, and…
Sophisticated npm malware campaign exploits Cross-Ecosystem typosquatting
A coordinated malware operation targeting npm employs cross-ecosystem typosquatting to mimic popular libraries from Python, Java, C++, and .NET ecosystems. Attackers uploaded packages like beautifulsoup4 (masquerading as Python’s BeautifulS…
Dismantling “764”: inside the takedown of a sophisticated child exploitation network
In a significant development for cybersecurity and child protection efforts, law enforcement agencies have successfully apprehended two key figures allegedly behind “764,” a highly organized online child exploitation network. This case repr…
Hijacking Trust: how Gmail and Google APIs are being weaponized for stealthy C2 channels
In the ever-evolving landscape of cybersecurity, attackers are increasingly exploiting trusted services to establish covert command-and-control (C2) channels. By leveraging platforms like Gmail and Google Drive, threat actors can mask malic…
Kintetsu World Express ransomware attack: technical overview and response
Kintetsu World Express (KWE), a major Japanese global logistics provider, has confirmed a significant ransomware attack that began impacting its operations in late April 2025. The incident has resulted in server outages and ongoing disrupti…
JFL Hospital targeted in ransomware attack amid wave of cyber incidents in US Virgin Islands
Governor Juan F. Luis Hospital & Medical Center (JFL) in the US Virgin Islands has become the latest government entity to suffer a cybersecurity breach, confirming a ransomware attack that compromised its computer networks on Sunday. The ho…
SuperCard X: exposing a MaaS for NFC Relay fraud operation
The Cleafy Threat Intelligence team has uncovered SuperCard X, a sophisticated Android malware campaign leveraging NFC-relay attacks to authorize fraudulent POS and ATM transactions. This Malware-as-a-Service (MaaS) operation1 primarily tar…
MITRE Signals Critical Risk to CVE Program as Federal Funding Expires
The cybersecurity world faces a significant challenge as the Common Vulnerabilities and Exposures (CVE) program, a cornerstone of global vulnerability management, risks disruption due to expiring federal funding. Managed by the MITRE Corpor…
Malicious NPM packages targeting PayPal users: a recap analysis
FortiGuard Labs recently uncovered a series of malicious NPM packages designed to steal sensitive information from compromised systems. These packages, created between March 5 and March 14, were attributed to a threat actor operating under…
Malicious VSCode extensions: a growing threat to developers
The Visual Studio Code (VSCode) Marketplace has recently become a target for sophisticated cyberattacks, with malicious extensions infiltrating development environments to deploy cryptominers. These attacks highlight vulnerabilities in the…
Everest ransomware gang faces unprecedented blow: leak site hacked and defaced
In a surprising turn of events, the Everest ransomware gang—a notorious Russia-linked cybercriminal organization—has suffered a significant setback. Over the weekend, their dark web leak site was hacked and defaced by an unknown attacker, l…
Surge in Palo Alto Networks scanner activity
GreyNoise has detected a significant surge in login scanning activity aimed at Palo Alto Networks PAN-OS GlobalProtect portals. In the last month, nearly 24,000 unique IP addresses have been observed attempting to gain access, suggesting a…