Home > Directory > Sicurezza > SecureBulletin
SecureBulletin EN
Cybersecurity news in English · visibilità: nel misto della home, non in primo piano.
Sito originale · Feed RSS della fonte
1.243 voci in archivio · mostrate 926–950 .
Crocodilus: a sophisticated new Android banking trojan emerges
A new Android banking trojan, dubbed Crocodilus, has been discovered targeting users primarily in Spain and Turkey. This malware isn’t just another clone; it’s a fully-fledged threat employing modern techniques from the outset. Key capabili…
Stealth malware strikes WordPress via MU-Plugins: a technical deep dive
The Sucuri research team has recently uncovered a concerning trend: threat actors are increasingly leveraging the WordPress mu-plugins directory to conceal malicious code. This tactic1 is particularly insidious because Must-Use plugins, res…
New breed of Android malware leverages .NET MAUI to slip past defenses
Exploiting cross-platform development frameworks to deliver insidious malware. A recent report from McAfee highlights the emergence of Android malware campaigns that are leveraging the .NET MAUI framework to evade detection and steal sensit…
Mamona ransomware group compromised: DragonForce exploits OPSEC failures
The cybersecurity landscape is once again witnessing the fallout of poor operational security (OPSEC) among ransomware operators. In the latest turn of events, Mamona, a ransomware group rebranded from BlackLock (also known as El Dorado), h…
Western Alliance Bank data breach: 21,899 customers impacted
The recent data breach at Western Alliance Bank underscores a growing concern in the cybersecurity landscape: the risks posed by third-party software vulnerabilities. This incident not only highlights the technical challenges of securing se…
MassJacker malware targets cryptocurrency of piracy users
A new and sophisticated malware campaign, known as MassJacker, has been uncovered by cybersecurity researchers at CyberArk. This malware targets users who download pirated software, particularly from websites like pesktop[.]com, which is no…
New Android spyware “KoSpy” linked to North Korean APT37
A new Android spyware, dubbed “KoSpy,” has been discovered by researchers at Lookout, adding another concerning tool to the arsenal of North Korean threat actors. This spyware, attributed with medium confidence to the APT37 group (also know…
The Ballista Botnet: a new IoT threat with italian roots
Cato Networks has uncovered a sophisticated IoT botnet, dubbed Ballista, targeting TP-Link Archer routers by exploiting a two-year-old vulnerability (CVE-2023-1389). This threat, linked to an Italian threat actor, underscores the persistent…
Akira ransomware’s ingenious IoT gambit: when webcams become cyberweapons
Akira group demonstrated how unsecured IoT devices can bypass enterprise-grade defenses. In a case analyzed by S-RM, attackers weaponized a vulnerable webcam to execute an end-run around EDR protections—a stark reminder that perimeter defen…
The CrazyHunter ransomware attack on Makai Hospital
On February 9, 2025, Makai Memorial Hospital in Taiwan became the latest victim of a devastating ransomware campaign orchestrated by the Hunter Ransom Group. The attack, which leveraged the CrazyHunter ransomware, disrupted critical healthc…
Fog’s dubious GitLab claims: investigation on instances
One name that has been gaining traction since late January is Fog, a ransomware operation that has been particularly vocal about targeting GitLab instances. Fog has claimed responsibility for attacks against approximately fifty organization…
Critical Remote Code Execution vulnerability discovered in GiveWP WordPress Plugin (CVE-2025-0912)
A critical security vulnerability, identified as CVE-2025-0912, has been discovered in the GiveWP WordPress donation plugin. This flaw potentially exposes over 100,000 WordPress websites to remote code execution (RCE) attacks. The vulnerabi…
TikTok Under Scrutiny: regulators probe teen data handling
TikTok, the massively popular short-form video platform, is once again in the crosshairs of regulators. The core issue? Concerns surrounding the platform’s handling of data, particularly that of its younger users. While details of the speci…
Black Basta and CACTUS ransomware: shared BackConnect module signals affiliate transition
Recent analysis has revealed a significant overlap in the tactics, techniques, and procedures (TTPs) employed by the Black Basta and CACTUS ransomware groups. Specifically, researchers have uncovered that both groups are leveraging the same…
Anubis: new ransomware threat
A new player has emerged in the ransomware landscape: Anubis. This group, first observed in December 2024, is quickly making a name for itself through a multi-faceted extortion model that goes beyond traditional ransomware-as-a-service (Raa…
Lazarus group’s Billion-Dollar Bybit heist: a cyber forensics analysis
The Lazarus Group, a notorious North Korean state-sponsored hacking collective, has once again demonstrated its sophistication and audacity with a staggering $1.5 billion cryptocurrency heist targeting Bybit, a major crypto exchange. This i…
Streamjacking scams target CS2 gamers during major esports events
The thrill of victory, the roar of the crowd, the allure of valuable in-game skins – these are the emotions that fuel the Counter-Strike 2 (CS2) esports scene. However, lurking in the shadows of these exciting tournaments is a growing threa…
Ghost Ransomware: an analysis of tactics, targets, and techniques
A joint advisory from CISA, the FBI, and the MS-ISAC sheds light on the activities of the Ghost ransomware gang, a cybercriminal group that has been actively targeting organizations across the globe since early 2021. This analysis, pieced t…
Russia-Aligned actors intensify targeting of Signal Messenger
Recent reporting from Google’s Threat Intelligence Group (GTIG) highlights a surge in activity from Russian state-aligned threat actors targeting Signal Messenger accounts. This campaign, likely driven by wartime intelligence demands relate…
Critical Palo Alto Firewall flaw under active attack: Patch NOW!
Security teams, take note: A critical vulnerability (CVE-2025-0108) in Palo Alto Networks’ PAN-OS is under active exploitation in the wild. Both CISA and security researchers are urging immediate patching to prevent potential breaches. The…
Pegasus spyware detected on 11 of 18,000 devices during one month of testing
Recent findings from iVerify have raised alarms about the pervasive threat of Pegasus spyware, traditionally associated with high-profile targets, now extending its reach to ordinary users. The security firm’s new Mobile Threat Hunting feat…
Oh Ship! Steam game “PirateFi” caught red-handed dropping password-stealing malware
Ahoy, gamers! Hope you weren’t sailing the high seas of Steam with a recently released free-to-play game called PirateFi. Turns out, this seemingly innocent survival title was caught hoisting the Jolly Roger of malware distribution, specifi…
Fog ransomware: a deep dive into its tactics and targets
Okay, I can do that! Here’s a short, discursive article about Fog Ransomware based on the provided document, written in English and suitable for online publication: Fog Ransomware emerged in April 2024 and quickly became a significant cyber…
RedMike (Salt Typhoon) continues global Telecom attacks
Despite widespread awareness and U.S. sanctions, the Chinese state-sponsored threat group RedMike (also known as Salt Typhoon) remains a persistent danger to telecommunications providers worldwide. Recent activity reveals RedMike actively e…
Students are suing to stop access to sensitive financial aid databases by Department of Government Efficiency members
A recent lawsuit filed by the University of California Student Association against the U.S. Department of Education highlights significant cybersecurity and privacy concerns surrounding data access by Elon Musk’s Department of Government Ef…