Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Latest News

Trezor Data Breach Exposes Personal Information of Nearly 14,000 Customers

  Hardware cryptocurrency wallet maker Trezor has disclosed a data breach involving the personal information of nearly 14,000 customers, af...

All the recent news you need to know
US Department of Justice
Cyber Security GrapheneOS GrapheneOS Foundation mobile privacy Sam Tunick US Department of Justice

GrapheneOS Foundation Defends Privacy Features Amid US Case Involving User

 The US Department of Justice’s recent case against GrapheneOS user Sam Tunick has renewed discussions about mobile privacy, digital security and the limits of law enforcement access to personal devices. The GrapheneOS Foundation has responded by defending its open-source operating system and clarifying how its security mechanisms handle deleted information.

The Toronto-based non-profit organization said GrapheneOS is a lawful operating system and rejected any suggestion that the software itself is connected to illegal activity. The foundation emphasized that it has no responsibility to weaken features intended to protect users and their data.

Based on Android and currently designed for Google Pixel devices, GrapheneOS incorporates several security and privacy protections. The foundation argues that developing, distributing or using the operating system is protected under US constitutional principles and that legislation specifically targeting its security capabilities could face constitutional challenges.

One of the features at the centre of the case is GrapheneOS’s "duress password." Tunick reportedly provided the password to a US Customs and Border Protection officer. The feature is designed to trigger an immediate wipe of a device when a specific password or PIN is entered under coercion.

When activated, the process removes the phone’s stored information, including eSIM data. According to the foundation, the wipe occurs immediately, cannot be interrupted and cannot subsequently be reversed. As a result, data erased through the feature cannot be recovered from the device.

Despite the attention surrounding the duress password, the GrapheneOS Foundation has stressed that it represents only one small component of the operating system’s broader security architecture. The organization also cautioned that using such a feature could potentially have physical or legal consequences, meaning users need to consider the risks before relying on it during encounters with authorities or other coercive situations.

The legal dispute is also focused on Tunick’s treatment during the encounter. His attorney has alleged that the border officer did not provide Miranda warnings and disregarded Tunick’s requests to consult a lawyer.

Tunick’s legal team is seeking the exclusion of evidence obtained during the incident. The attorney has argued that the evidence should be dismissed because the authorities allegedly violated Tunick’s constitutional rights.

The case has consequently raised broader questions about the balance between individual privacy, device security and government authority, while putting renewed attention on how privacy-focused operating systems handle data deletion and compelled device access.

Read more »
Zero-Day
DNS Attack Drift OAuth token hack email security exchange Laundry Bear microsoft OWA Zero-Day

Russian Hackers Use Exchange Zero-Day in Email Attacks

 



Russia-aligned cyberespionage group Laundry Bear, also tracked as Void Blizzard and TA488, is exploiting a Microsoft Exchange Outlook Web Access (OWA) vulnerability to deploy a browser-based backdoor capable of maintaining access to victims' mailboxes even after credentials are changed or systems are reimaged.

Email security firm Proofpoint said it observed the campaign targeting government organizations in the US and Europe, as well as telecommunications, financial, hospitality and aerospace organizations. The activity uses OWAReaper, a sophisticated backdoor delivered through malicious emails exploiting CVE-2026-42897.

CVE-2026-42897 is a cross-site scripting vulnerability caused by inadequate HTML sanitization in OWA. A specially crafted email can contain malicious JavaScript that executes when the recipient opens the message in OWA. Proofpoint calls the technique a "half-click" exploit because opening the email can be enough to trigger the attack, without requiring the victim to click a link or open an attachment. Microsoft disclosed the vulnerability on May 14, 2026, and confirmed active exploitation.

Proofpoint found that infrastructure associated with the campaign had been established as early as March, nearly two months before Microsoft's disclosure, suggesting TA488 may have exploited the vulnerability as a zero-day. The group used ordinary-looking subjects concerning supply chains, research updates, tourism, gas markets and other industry-related information, making the messages less likely to be treated as malicious.

The emails contained JavaScript loaders and Base64-encoded payload fragments hidden within URLs associated with social-media-style icons. Once triggered, the code assembled and executed the OWAReaper payload.

OWAReaper operates entirely within the OWA reading pane. It can collect the victim's email address, username and Outlook configuration, while also attempting to capture credentials by creating invisible DOM elements that allow the browser's autofill mechanism to populate usernames and passwords.

The backdoor's most concerning capability is its persistence. It searches for Outlook add-ins with "ReadWriteMailbox" permissions and can use the "GetClientAccessToken" operation to obtain OAuth tokens. It then abuses Exchange's "UpdateFolder" operation to grant Owner-level permissions to the "Default" user across the victim's mail folders.

Because these permissions are stored server-side, changing the victim's password or reinstalling the compromised computer does not necessarily remove the attacker's access. OWAReaper also enables browser caching and places a malicious iframe into messages stored in OWA's offline IndexedDB database, allowing the payload to execute again when a poisoned message is opened from the cache.

The malware uses multiple channels for command and control. It periodically searches GitHub commit messages for encrypted commands containing the victim's email address and can also receive commands through specially formatted emails stored in OWA's cache.

For data theft, OWAReaper primarily uses HTTPS with encrypted URI paths that can be routed through image CDN services. It also has a direct-server fallback and a DNS-based exfiltration mechanism that encrypts and Base32-encodes stolen data before transmitting it through DNS queries.

Proofpoint linked OWAReaper to TA488 based on behavioral similarities with ZimReaper, malware previously used by the group against Zimbra email servers. In that campaign, TA488 exploited another XSS flaw, CVE-2025-66376, to steal emails, passwords, application passcodes and two-factor authentication codes.

The latest campaign therefore represents an evolution of the group's "half-click" approach, shifting from compromising individual webmail sessions toward establishing persistent access within the victim's mailbox environment.

Microsoft has since released security updates addressing CVE-2026-42897. The July 2026 Exchange Server update states that the code fix is available, while organizations that previously applied Microsoft's mitigation must follow Microsoft's guidance to remove it after installing the update. The vulnerability affects on-premises Exchange Server deployments, while Exchange Online is not affected.

Proofpoint has published indicators of compromise for the campaign, including malicious domains and the HTML message body containing the exploit and OWAReaper payload. Organizations using affected on-premises Exchange deployments should therefore investigate not only compromised endpoints, but also mailbox permissions, OAuth tokens and OWA browser storage when responding to suspected exploitation.

Read more »
Iranian cyber group
Cyber Attacks cybercrime group Cybersecurity Agencies Hacking Attack Hacking Group Iranian cyber group

Iran-Linked Hackers Suspected in Cyberattacks Targeting Minnesota Water Systems

 

Several water systems in Minnesota were under attack from cyber intruders over the weekend. Investigators believe the attacks were launched from an Iranian hacking group called CyberAv3ngers. The attacks targeted approximately 30 water systems in Minnesota on Sunday and Monday and caused a brief interruption in the water supply for one community. 

The most significant attack was in the small town of Braham, located in the Minneapolis area, which was without water for two hours due to a cyberattack. The water supply was cut off, but it was quickly restored. Cybersecurity firm Tenable indicated that the attack methods used were similar to those previously used by the Iranian hacking group. US authorities are investigating whether Iran was behind the cyberattack on the water systems in Minnesota. 

However, officials do not believe that the attacks in Minnesota were carried out by Iran or that the attacks were orchestrated by the group CyberAv3ngers. The attacks in Minnesota occurred shortly after the US Cybersecurity and Infrastructure Security Agency issued an alert about attacks launched by Iran’s proxies on internet-connected systems controlled by infrastructure operators. This warning highlighted the potential for such groups to target critical infrastructure. Water utilities may be particularly vulnerable to such attacks since they use internet-connected machines to control and monitor operations. 

A relatively small amount of protection of these machines can allow hackers to intervene in the functioning of critical infrastructure, even if they cannot access the main corporate IT system. CyberAv3ngers has been accused of targeting industrial control systems by various companies, including water utilities, in the past. This hacking group has attracted increased attention from US authorities due to its suspected Iranian origin and potential access to critical infrastructure. The attack on Minnesota water utilities is part of a wave of cyberattacks launched against the US and its allies. 

Another hacking group, Handala, claimed to have attacked the medical equipment company Stryker and the payment processing company Verifone. Stryker confirmed that it was a victim of a cyberattack, while Verifone rejected the accusations. The group Handala claimed that it carried out these attacks in retaliation for the US-Israeli military operation against Iran. The attack by Handala was reportedly in response to the assassination of an Iranian military commander and the bombing of a school in Iran, which resulted in the death of more than 150 people. 

The US military investigation concluded that the attack on the school in Minab was due to the “inadvertent engagement” of the school by US aircraft, which was targeting a military installation. The attacks on the water utilities in Minnesota illustrate the potential for geopolitical tensions to spill over into attacks on critical infrastructure. Even though it is unclear whether the attacks in Minnesota were launched by Iran, the fact that they were able to occur highlights the need for increased protection of internet-connected infrastructure equipment, as well as monitoring and rapid response systems.
Read more »
Technology
Apple iPhone Mac Supply Chain Technology

Apple Warns of Supply Crunch as Demand Surges

 

Apple’s issue is a supply crunch: strong demand for iPhones and Macs is outpacing the company’s ability to secure key components, especially advanced chips and memory. The BBC report says Apple warned this could hit revenue in the coming months and that supply constraints are already limiting flexibility in the chain. 

What is happening 

Apple said the core problem is not weak demand but the opposite — sales are running hotter than expected, particularly for iPhone and Mac products. The company described the supply situation as “very significant,” with little room to quickly fix it. That means Apple can sell more devices than it can comfortably produce, which creates delays, pressure on inventory, and a risk of missed sales. 

The shortage affects some of Apple’s most important products, so even a strong quarter can come with a weaker outlook. Apple’s shares fell after the warning because investors tend to react sharply when a company says future growth may slow. The BBC also noted that Apple has already raised prices on some products, showing how supply costs are beginning to affect customers.

A major part of the problem is the cost and availability of memory chips, which have surged in price due to broader industry demand, including AI-related hardware needs. Reuters reported that Apple is also dealing with bottlenecks in advanced chipmaking technology used in its Apple silicon chips. In practical terms, this means Apple may have to pay more for parts, accept tighter margins, or pass costs on to buyers. 

Financial impact 

Despite the warning, Apple’s recent results were still strong, with iPhone and Mac sales rising sharply. But the company signaled that the next quarter may not keep pace if component shortages persist. That is why the story is less about a current collapse and more about a future squeeze on growth. 

Apple’s problem reflects a bigger technology trend: demand for chips is rising across consumer devices and AI infrastructure at the same time. When a company as large as Apple struggles to source parts, it often signals pressure across the wider electronics supply chain. In this case, the issue is a mix of extraordinary demand, limited supply flexibility, and rising component prices.
Read more »
U.S. Cybersecurity
Cyber Attacks cyber operations Cyber Threats Offensive Cybersecurity Private Sector Cybersecurity Transnational Cybercrime Trump Cyber Policy U.S. Cybersecurity

Trump Memo Signals New U.S. Push to Disrupt Foreign Cybercrime Groups


The memo from the White House signed by President Donald Trump will increase the role of cybersecurity companies in fighting foreign criminal organizations that operate across borders. The National Coordination Center will be responsible for developing a program that allows government-approved cyber activities against these groups. 


According to the plan authorized American companies could carry out approved cyber monitoring and cyber impact missions against targets linked to these criminal groups while being watched by the government. 

Information systems and infrastructure might be affected during these activities, including the loss of data. With this effort the government wants to improve how it deals with cybercrime, fraud and other illegal acts that affect American people. Working with the Department of Justice the Department of Homeland Security will set up and run the program through the National Cyber Security Council. 

Companies involved in the program must have an escrow or a bond of least one million dollars and must operate with the required government permissions. The plan encourages sharing information, between businesses and government agencies at every level, including federal, state, local, tribal and territorial authorities to spot possible cyber threats and develop ways to deal with them. The issue of companies being involved in offensive cyber activities is a big deal. This has caused people to worry about things getting out of hand someone getting hurt by mistake and the government and private companies having trouble working together. 

The program is only going after foreign cyber crime groups that want to hurt the United States government, American people or American interests long as these groups do not work for a foreign government. A company has to stop what it is doing if it does something it is not supposed to do, like going after people or systems. 

The company also has to tell the NCC about this so they can send it to the Justice Department. This is part of a program started by the White House in March to deal with criminal groups from other countries that are involved in ransomware, malware, phishing, financial fraud, sextortion, impersonation and pig butchering schemes. 

The White House said that American people have lost a total of $20.8 billion because of cyber crimes. If a company wants to be part of this it has to follow some strict rules. The private sector participation in cyber activities has to be done carefully. Private sector participation, in cyber activities is a serious matter. 

Along with sharing information about threats with businesses and government groups companies that take part might also suggest actions that need permission from the federal government. This policy has started conversations about how much the business world should be involved in taking offensive actions in the cyber world. Someone who supports the program sees it as a chance to use skills from the private sector to fight more powerful criminal groups.

Someone who is against it warns that having more businesses take part in offensive actions could lead to legal problems more chances of things getting worse and results that were not expected. Cyber crime is a problem that affects governments everywhere. 

German intelligence groups have also taken steps to make their own groups stronger so they can stop the cyber networks of enemies. This shows that governments are becoming more ready to use ways to protect themselves and take action. A memo from the time of the Trump administration shows a change in what private cybersecurity companies will do, in the future. 

If the framework can really stop criminal networks without going against the law or making new security problems then how it is watched over and approved will be very important to how well it works. The United States is showing a change in how it deals with cybercrime by doing this. It is clear that the government and private cybersecurity companies need to work to stop cyber threats. 

Several things will decide if this works, such as making sure someone is watching over it following the law and taking steps to avoid things going wrong. The framework needs to be good at stopping criminal networks. The framework will be important to the United States and its plan to deal with cybercrime. The framework and its oversight and authorization processes will be crucial, to its success.
Read more »
Zero Day
CVE GeoServer RCE Vulnerabilities and Exploits Zero Day

GeoServer Zero Day Being Probed While No Patch Available


A newly found GeoServer zero-day is already receiving active exploitation efforts, while there is no patch ready yet. Firms using the open-source geospatial platform should keep an eye out for their exposure. 

A cybersecurity expert with the handle q1uf3ng found the vulnerability which has not been given any CVE identifier yet.

Zero-day with no patch

The vulnerability exists in the jsonArrayContains functionality and permits illegal SQL injection. In few configurations, particularly where the flaw can reach a privileged database account, that path may result in remote code execution. The vulnerability has not been given any CVE identifier yet. 

The flaw was publicly revealed on 12 August 2026. Soon after, watchTowr said it started noticing exploitation attempts, with hundreds of attempts coming from a few IP addresses. According to WatchTowr’s Jake Knott, “Within hours of public disclosure, we began observing exploitation attempts and have since recorded hundreds of attempts originating from a small number of source IP addresses. Yet another example of how quickly attackers move once a vulnerability enters the public domain.”

The timing is crucial here. When enough technical information or proof of concept is public, threat actors don’t have to wait for a well planned exploit. They can compare responses, scan broadly, trigger errors, and make a list of devices to visit later. It is spying with an error message as a compass.

Cyber criminals are probing the flawed GeoServer systems, but no confirmed exploit has been found yet. But experts have warned that exploitation could soon happen. 

According to Knott, “However, this is unlikely to remain the case for long: GeoServer has a track record of being targeted and exploited at scale, with multiple vulnerabilities listed in CISA’s Known Exploited Vulnerabilities catalog. With no patch currently available and exploitation already underway, organizations running GeoServer should take this vulnerability seriously and, where possible, identify exposed instances, restrict public access, and monitor for a vendor fix.”

Threat actors are triggering errors to find vulnerable targets before active exploitation, and probing GeoServer systems for unpatched zero-day.

About GeoServer

A well-liked framework for exchanging and publishing geographic data via web services is called GeoServer. Public sector portals, environmental platforms, mapping initiatives, utilities, transportation systems, academic institutions, and internal corporate applications are some of the places where it can be found. Because of this, a remotely reachable instance becomes more than just a technical detail; it may provide credentials, backend services, geographic data, or a path to a larger network.

Read more »
Subscribe to: Posts (Atom)

Featured