Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Cyber Attacks. Show all posts
Hacking Group
Cyber Attacks Cyber Outage Digital Learning E-learning Facebook Canvas Hacker attack Hacking Group

Canvas Learning Platform Outage Disrupts Universities After ShinyHunters Cyberattack

 

Midday classes hit pause when Canvas went offline nationwide following a security alert that triggered emergency repairs. Though the issue began in Texas, ripple effects reached campuses far outside, cutting off vital links to homework and recorded lectures. When servers dropped, so did access - assignments vanished from view, gradebooks locked tight. Some professors switched to paper handouts; others postponed deadlines without warning. 

By evening, partial functions returned, though glitches lingered like static on a radio. Not every login worked smoothly, leaving doubts about full recovery. Reports suggest a connection between the incident and ShinyHunters, a hacking collective lately seen exploiting cloud systems by leveraging weak points in external service providers. Though details remain limited, evidence traces back to prior attacks where stolen information was used as leverage against corporate networks. 

Instead of relying on brute force, the group often manipulates access flaws within shared digital environments. While some breaches go unnoticed at first, forensic analysis later reveals patterns matching earlier intrusions tied to similar tactics. Later came confirmation from Instructure - Canvas's developer - that the platform had entered temporary maintenance mode after the event unfolded. Though restoration of service remained possible, according to officials, institutions using the system faced urgent hurdles just when course activities demanded stability. 

Despite assurances, timing turned problematic for schools depending heavily on seamless access at a pivotal point in the term. Midway through the week, campuses like Southern Methodist University felt the strain as systems went offline. Not far behind, the University of North Texas System faced similar disruptions, slowing down daily functions. At Baylor University, staff worked under pressure - rescheduling classes became a priority. Meanwhile, Tarrant County College saw delays ripple across departments. With email and portals unreliable, instructors adapted on the fly while leadership tried to reconnect threads. 

Because updates lagged, many waited hours just to confirm basic plans. Final exams set for Friday at Southern Methodist University got pushed to Sunday after a widespread system failure left services down. Because of the same national disruption, Baylor University rescheduled its tests too, alerting learners that interruptions might stretch on without clear timing. Officials admitted they lacked answers about how long things would stay broken - access may return in hours or drag into multiple days. 

Across town, the University of North Texas System cut off broad access to Canvas until faculty and tech experts figured out next steps for ongoing classes, scores, and year-end tests. Farther south, Tarrant County College acknowledged its digital crews were checking the breach, watching for ripples among learners and workers alike. Unexpected outages reveal how tightly schools now rely on centralised online learning systems. 

Not only do tools such as Canvas support daily teaching tasks, but they also handle submission tracking, feedback cycles, and course materials distribution. Should access fail, functions stall - particularly under pressure, like mid-semester assessments. Interruptions expose fragile infrastructure beneath routine digital workflows. What stands out is how this event ties into a wider pattern - cyber gangs increasingly going after schools and companies that run online platforms. 

Though they hold vast collections of student records and private details, many learning organizations lack strong digital defenses. Because of these gaps, threat actors see them as easier wins when chasing ransom payments. Still probing the incident, campuses now shift toward regular classes - though officials stay alert for leaked data. This disruption highlights once more that when hackers strike common online systems, ripple effects hit countless people at many schools all at once.
Read more »
Vishing Attack
BlackFile Extortion Cyber Attacks Hospitality Data Theft IT Impersonation Vishing Attack

BlackFile Extortion Gang Targets Retail and Hospitality Sectors

 

A new cyber threat actor known as BlackFile has emerged, launching data theft and extortion campaigns against retail and hospitality organizations since February 2026. Tracked also as CL-CRI-1116, UNC6671, and Cordial Spider, the group employs sophisticated vishing attacks by impersonating IT helpdesk staff via spoofed VoIP calls. This tactic preys on frontline employees, tricking them into revealing credentials on fake SSO login pages. 

BlackFile's attack chain begins with urgent phone calls claiming account security issues, directing victims to pixel-perfect phishing sites for credentials and MFA codes. Attackers then register rogue devices to bypass MFA, escalate privileges by scraping employee directories, and exploit SaaS APIs like Microsoft Graph and Salesforce to exfiltrate sensitive data. They target files with keywords such as "confidential," "SSN," or "salary," downloading massive volumes under legitimate-looking sessions. 

Unlike ransomware groups focused on encryption, BlackFile prioritizes pure extortion, leaking stolen data—including customer PII and employee records—on dark web sites before contacting victims. Demands reach seven figures, delivered via compromised emails or random Gmail addresses, with added pressure from psychological tactics like swatting executives. Researchers from Palo Alto Networks' Unit 42 link BlackFile with moderate confidence to "The Com," a network tied to broader cybercrimes.

The group's success exploits high staff turnover in retail and hospitality, where social engineering evades traditional defenses. RH-ISAC warns of rising incidents, noting similarities to groups like ShinyHunters. As SaaS platforms hold crown-jewel data, BlackFile signals a shift to "extortion-first" models, blending digital theft with real-world harassment. 

To counter BlackFile, organizations must enforce "callback" protocols—employees hang up and verify via internal lines—and audit SSO logs for suspicious device registrations. Regular social engineering training, API key rotations, and executive swatting briefings are essential for frontline resilience. Retail and hospitality firms ignoring these risks face multimillion-dollar breaches in 2026's volatile threat landscape.
Read more »
High Value Cybercrime
critical infrastructure attack Cyber Attacks Cyber Security Ransomware Attacks cyberattacks increase cybercriminals Ransomware Attack High Value Cybercrime

Targeted Ransomware Attacks Rise as Cybercriminals Shift Focus Toward High-Value Victims

 

Surprisingly, cyber attackers now prefer precision over volume, shifting from broad campaigns to targeted strikes meant to inflict severe damage on fewer targets. Although nationwide ransomware incidents declined in the UK last year, data collected by SonicWall reveals a rise in successful breaches across businesses. Instead of casting wide nets, hackers fine-tune their efforts, making each attempt harder to detect. 

What stands out is not the frequency of attacks but how many actually succeed. Focusing narrowly allows intruders to adapt quickly, exploiting specific weaknesses others might overlook. Eighty-seven percent fewer ransomware incidents were reported, though twenty percent more organizations faced breaches - a sign tactics have changed. Rather than casting wide nets, attackers now focus on specific companies with better odds of success or higher returns. Picking targets deliberately has become the norm, shifting away from mass campaigns toward precision strikes. 

One tactic draws attention by targeting firms with shaky safeguards - outdated systems, reliance on fragile operations. Called “big game hunting,” it zeroes in on weakness rather than strength. Smaller companies often find themselves in the line of fire. Breaches here frequently involve ransomware, showing up in 88% of cases. Larger organizations face such attacks less often, at only 39%. Vulnerability shapes who gets hit hardest. Older systems, sometimes called zombie tech, pose growing dangers according to security experts. 

Because updates stop for these outdated platforms, hackers find them easier targets - flaws linger without fixes. A case in point: a weakness first found ten years ago in Hikvision internet-connected cameras. In just twelve months across the UK, attackers tried to use this opening nearly 67 million times. About one out of every five break-in attempts logged by monitoring teams tied back to this issue alone. Surprisingly, few organizations grasp the duration attackers often stay undetected in their networks. 

Although the majority of IT leaders thought breaches would be spotted quickly - within hours - the data showed intruders typically lingered around 181 days. That mismatch, perception versus reality, opens space for malicious activity to unfold slowly, unnoticed. Quietly, threats spread across digital environments well before anyone responds. What once moved slowly now races forward - artificial intelligence fuels sharper rises in digital dangers. 

A surge appears: studies show nearly nine out of ten incidents involve AI-powered tools. Scanning nonstop, machines probe countless online points each moment, hunting weak spots. Speed becomes their weapon; defenses lag behind as holes get found quicker than fixes go live. Years go by, yet many organizations still run systems riddled with outdated flaws - perfect openings for digital intruders. 

Not only do skilled ransomware operators refine their tactics constantly, but they also rely on neglect: gaps known for ages stay unfixed. Danger grows quietly when precision strikes meet ignored risks. Small firms face just as much threat as large ones, simply because exposure piles up over time. Even basic protections often come too late, if at all. Though many still overlook it, keeping software up to date plays a key role in staying secure online. 

Instead of waiting for problems, frequent checks across networks help catch risks early. Some companies run into trouble simply because they trust aging tools too much. Old flaws thought harmless yesterday might open doors today. Attackers adapt quickly - especially those deploying tailored ransomware attacks. As these threats grow sharper, so does the risk for unprepared teams.
Read more »
User Security
Cyber Attacks Financial Scam Srilanka User Security

Sri Lanka Finance Ministry Loses $2.5 Million in Cyberattack on Payment System

 

Sri Lanka is trying to recover $2.5 million after a cyberattack on the Finance Ministry’s payment system redirected funds away from their intended recipient, exposing fresh weaknesses in the country’s public financial controls. Officials say the breach involved email manipulation, and the issue surfaced after opposition lawmakers alleged that treasury money had landed in a hacker’s account instead of reaching the correct creditor. The incident has prompted a high-level probe, with authorities treating it as both a financial loss and a serious security breach. 

According to finance ministry secretary Harshana Suriyapperuma, cybercriminals were first detected trying to enter the External Resources Department’s system in January 2026, and the ministry took steps with overseas partners to stop further damage. He said the earlier attempt was contained, but the later payment breach still led to losses that are now under review. The stolen amount formed part of a larger $22.9 million payment, with $2.5 million reportedly disbursed between December 2025 and January 31, 2026. 

The incident has drawn wider attention because it involves government debt repayment funds and an apparent failure in payment verification. Australia’s high commissioner in Sri Lanka said Canberra was aware of irregularities in payments owed to it, and Australian officials are assisting the investigation. That international angle has made the breach more sensitive, since the diverted funds were tied to a sovereign obligation rather than a routine domestic transaction. 

A high-powered committee has been formed to investigate the hacking incident and identify how the payment was rerouted. Opposition lawyers have also asked Parliament to examine the matter, arguing that public finances fall under legislative oversight. The issue has been raised before the Committee on Public Accounts, adding political pressure on the government to explain how the breach happened and whether more funds may have been exposed. 

The episode is a damaging reminder that cyberattacks can hit not just banks and companies but also state payment systems handling international debt obligations. For Sri Lanka, which is still recovering from its severe economic crisis and debt default, even a single diverted payment can deepen concerns about administrative safeguards and digital resilience. The investigation will likely focus on email security, approval controls, and how quickly suspicious payment changes were detected.
Read more »
Threat Intelligence
Cyber Attacks Endpoint security Initial Access Broker Phishing Attack Ransomware Precursor RMM Exploitation ScreenConnect Threat SimpleHelp Abuse Threat Intelligence

Over 80 Organisations Impacted by Phishing Leveraging SimpleHelp and ScreenConnect

 


Researchers have identified a systematic intrusion operation that is utilizing remote management utilities, and recent findings reinforce this shift in phishing campaigns, which have evolved from opportunistic scams to structured intrusion operations. 

Researchers have identified an ongoing campaign that has compromised more than 80 organizations across multiple industries since April 2025, with a significant concentration in the United States. In the operation, malicious software is deliberately used, allowing attackers to establish covert and persistent access under the guise of legitimate administrative activity through the deliberate use of vendor-signed Remote Monitoring and Management software. 

Through the deployment of modified versions of SimpleHelp and ScreenConnect, the threat actors have effectively bypassed conventional security controls, relying on trusted installation workflows initiated by innocent individuals. 

The activity aligns with previously observed clusters tracked by independent security teams, but this latest analysis provides enhanced insight into the campaign's indicators, behavior, and operational sophistication, highlighting a coordinated effort that is extending its reach in a coordinated fashion. 

Securonix analysis, which tracks the VENOMOUS#HELPER activity cluster, shows that the operation has maintained continuous momentum since April 2025, extending its reach beyond the U.S. into Western Europe and Latin America. 

The campaign is distinguished by its calculated use of two Remote Monitoring and Management platforms, SimpleHelp and ScreenConnect both of which are legitimately signed and widely utilized by enterprises. Rather than deploying conventional malware payloads, threat actors employ these trusted tools to embed persistent access within victim systems, effectively blending malicious activity with routine administrative functions in order to achieve effective results. 

By using two RMM solutions in parallel, there is built-in redundancy, which ensures access continues regardless of whether a channel is detected and removed. Although no formal attribution has been established, Securonix concludes that these operational patterns are consistent with financial motivated Initial Access Brokers and early-stage ransomware campaigns, particularly those targeting organizations in economically significant regions. 

The activity cluster, known as VENOMOUS#HELPER, continues to demonstrate significant overlap with threat patterns previously documented by Red Canary and Sophos, whose designation for it is STAC6405, based on these findings. Although its operational characteristics are consistent with financial-driven initial access brokerage or early-stage ransomware enablement, its attribution remains unclear. 

A researcher involved in the investigation indicates that by deploying SimpleHelp and ScreenConnect in customized configurations, the campaign is able to circumvent conventional defensive mechanisms by embedding itself within legitimate administrative workflows, which allows attackers to bypass conventional defensive mechanisms. 

Additionally, a deliberate dual-channel access strategy is used to strengthen the resilience and continuity of control, even if one access vector is identified and neutralised. The intrusion sequence is initiated through a carefully crafted phishing email impersonating the U.S. Social Security Administration, asking recipients to verify their email address and download a purported statement via an embedded link. 

In an attempt to bypass email filtering systems, the link does not redirect victims to an overtly suspicious infrastructure; instead, it redirects victims to a legitimate Mexican business domain that is compromised, but otherwise legitimate. A disguised executable masquerading as an official document is retrieved from a secondary attacker-controlled domain in order to stage the subsequent payload delivery. 

A compromised cPanel account on a legitimate hosting environment was used to create the infrastructure for this purpose. When the JWrapper-packaged Windows binary is executed, it initiates a sequence aimed at ensuring persistence and stability of the application. Windows services are configured to survive Safe Mode conditions and employ a self-healing watchdog mechanism for automatic restoration of execution if terminated. 

Parallel to periodic reconnaissance, the implant queries the root/SecurityCenter2 WMI namespace to enumerate installed security solutions periodically. It is also configured to poll users on a periodic basis in order to monitor user activity. A combination of these behaviors illustrates a high level of technical maturity that is intended to maintain low-visibility access within compromised environments over long periods of time. 

STAC6405 infection chain reveals a methodical, multi-stage delivery framework designed to delay suspicion until execution has been established firmly on the victim computer. In the first stage, the intrusion begins with phishing emails impersonating the U.S. Social Security Administration, informing recipients of the recently released statement and requesting immediate action. 

In place of utilizing attacker-registered infrastructure, the embedded link redirects to a compromised but legitimate Mexican domain, a method designed to circumvent Secure Email Gateway filtering by utilizing the inherent trust that is associated with established .com.mx domains. Users are required to confirm their email addresses on the landing page to proceed with the SSA verification interface. This intermediate harvesting step not only validates the target’s authenticity but also provides attackers with an established communication channel to target them in the future. 

In response to this interaction, victims are seamlessly redirected to an attacker-controlled secondary host where a payload is staged for download. Based on the delivery URL structure, it appears to have been a compromise of a single cPanel account in a shared hosting environment, as indicated by the tilde-prefixed directory names. This report emphasizes the fact that the primary website infrastructure remains intact, with malicious content confined to a subdirectory deliberately named to maintain thematic consistency with the lure involving Social Security. 

To conceal the binary's true nature, the final payload, which is distributed as a Windows executable, takes advantage of default operating system behavior. File extensions are hidden in Explorer, which makes the binary appear legitimate, while JWrapper packaging incorporates customised visual elements such as iconography and splash screens to reinforce the authenticity of the binary. 

At each stage of execution, STAC6405 prioritizes credibility, evasion, and user manipulation in an effort to convey a carefully orchestrated delivery mechanism. The foundation of STAC6405's effectiveness lies in the use of calculated methods to exploit implicit trust in remote administration programs.

In addition, both SimpleHelp and ScreenConnect binaries are signed with Authenticode certificates, issued by globally recognized certificate authorities, which enables them to pass signature-based security checks seamlessly. These binaries are not flagged by traditional antivirus controls, Windows SmartScreen and Mark-of-the-Web protections are effectively neutralized, and endpoint detection mechanisms are forced to make use of behavioral telemetry, such as process lineage, rather than static indicators, such as file hashes, to detect endpoints. 

A network perspective indicates that outbound traffic is blending with legitimate activity by communicating with infrastructure that appears consistent with commercial software usage rather than overt command-and-control mechanisms. A cracked distribution of SimpleHelp, version 5.0.1 compiled in July 2017, aligns with the instance deployed in this campaign, which was widely circulated in underground forums between 2016 and 2019. 

Due to its expiring certificate window and lack of license validation mechanisms, it is highly likely that the tool has been deployed without financial traceability or vendor oversight by threat actors. The foundation supports a dual-RMM architecture that is purposefully engineered to fulfill distinct operational roles while bolstering the persistence of the other tools. 

The SimpleHelp application primarily utilizes UDP and HTTP communications over port 5555 to connect directly to an IP-based command endpoint for automated surveillance, scripted execution, and low visibility control. By contrast, ScreenConnect facilitates interactive, hands-on keyboard access over TCP port 8041 by using a proprietary relay protocol whose domain is controlled by an attacker. 

By separating these channels, not only is operational flexibility enhanced, but a resilient environment is created which ensures that disruption of one channel does not lead to the complete loss of access to the attacker. 

Remote administration capabilities are available through the SimpleHelp deployment, which includes full desktop control through VNC-based interaction, command execution by a virtual terminal bridge, silent session establishment without notification of the user, and privilege escalation mechanisms that bypass conventional user account control prompts. 

A number of additional features further reinforce persistence, including bidirectional file transfer, automated firewall rule modification, remote scripting, and self-healing service restoration. Cross-platform binaries are also indicative of adaptability, as they indicate that the same toolkit can be used on macOS and Linux systems as well, thereby expanding the potential attack surface and maintaining the same operational footprint across the same platforms. 

VENOMOUS#HELPER illustrates a measured shift in adversary tradecraft where stealth, legitimacy, and operational resilience are given greater priority than traditional malware deployments. By integrating themselves within trusted administrative ecosystems and utilizing a dual-RMM framework, operators dissolve the distinction between benign and malicious activity, creating a complex detection and response process. 

There was an intentional effort to circumvent conventional controls at every stage of the intrusion life cycle by means of the campaign's structured delivery chain, abuse of compromised infrastructure, and use of signed binaries. Therefore, defensive strategies based solely on signature detection or known indicators fail to be sufficient in this context.

Organisations, therefore, must reevaluate their security posture toward behavioural analysis, tight control over remote access tools, and continuous monitoring of the relationships between processes and the use of privileges. As threat actors refine these techniques, the campaign is a clear indicator that trusted software is becoming increasingly effective for executing untrusted intent in the cyberspace.
Read more »
Vishing
Cloud systems Credentials Stolen Cyber Attacks Extortion Fake Login phishing saaS Vishing

Hackers Target Cloud Apps Using Phone Scams and Login Tricks



Cybersecurity researchers have identified two threat groups that are executing fast-moving attacks almost entirely within software-as-a-service environments, allowing them to operate with very little visible trace of intrusion.

The groups, tracked as Cordial Spider and Snarky Spider, are also known by multiple alternate identifiers across different security vendors. Investigations show that both groups are involved in high-speed data theft followed by extortion attempts, and their methods show a strong overlap in how operations are carried out. Analysts assess that these groups have been active since at least October 2025. One of them is believed to be composed of native English speakers and is linked to a cybercrime network widely referred to as “The Com.”

According to findings from CrowdStrike, these attackers primarily rely on voice phishing, also known as vishing, to initiate their intrusions. In these cases, individuals are contacted and guided toward fraudulent login pages that are designed to imitate single sign-on systems. These pages act as adversary-in-the-middle setups, meaning they intercept and capture authentication data, including login credentials and session details, as the victim enters them. Once this information is obtained, attackers immediately use it to access SaaS applications that are connected through single sign-on integrations.

Researchers explain that the attackers deliberately operate within trusted SaaS platforms to avoid raising suspicion. Because their activity takes place inside legitimate services already used by organizations, their presence generates fewer detectable signals. This allows them to move quickly from initial compromise to data access. The combination of speed, targeted execution, and reliance on SaaS-only environments makes it harder for defenders to monitor and respond effectively.

Earlier research published in January 2026 by Mandiant revealed that these attack patterns represent a continuation of tactics seen in extortion-focused campaigns linked to the ShinyHunters group. These operations involve impersonating IT staff during phone calls to build trust with victims, then directing them to phishing pages in order to collect both login credentials and multi-factor authentication codes.

More recent analysis from Palo Alto Networks Unit 42 and the Retail & Hospitality ISAC indicates, with moderate confidence, that one of the identified clusters is associated with The Com network. These attacks rely heavily on living-off-the-land techniques, where attackers use legitimate system tools instead of introducing malware. They also make use of residential proxy networks to mask their real geographic location and to evade basic IP-based security filtering systems.

Since February 2026, activity linked to one of these clusters has been directed toward organizations in the retail and hospitality sectors. The attackers combine vishing calls, often impersonating IT help desk personnel, with phishing websites designed to capture employee credentials.

Once access is established, the attackers take steps to maintain long-term control. They register a new device within the compromised account to ensure continued access, and in many cases remove previously registered devices. After doing so, they modify email settings by creating inbox rules that automatically delete notifications related to new device logins or suspicious activity, preventing the legitimate user from being alerted.

Following initial access, the attackers shift their focus toward accounts with higher privileges. They collect internal information, such as employee directories, to identify individuals with elevated access and then use further social engineering techniques to compromise those accounts as well. With increased privileges, they move across SaaS platforms including Google Workspace, HubSpot, Microsoft SharePoint, and Salesforce, searching for sensitive documents and business-critical data. Any valuable information is then exfiltrated to infrastructure controlled by the attackers.

Researchers note that in many observed cases, the stolen credentials provide access to the organization’s identity provider, which acts as a central authentication system. This creates a single entry point into multiple SaaS applications. By exploiting the trust relationships between the identity provider and connected services, attackers are able to move across the organization’s cloud ecosystem without needing to compromise each application separately. This allows them to access multiple systems using a single authenticated session.


Read more »
Root Access Exploit
CISA KEV catalog Container Security Risk CVE-2026-31431 Cyber Attacks Kernel Exploit Detection Linux Kernel Vulnerability Linux Security Patch Privilege Escalation Root Access Exploit

CISA Highlights CVE-2026-31431 as an Active Linux Root Exploitation Risk


 

Several vulnerabilities in the Linux kernel have been recently disclosed that have attracted heightened scrutiny from the cybersecurity community, following evidence that they can be exploited to obtain full root-level control across a wide range of systems consistently. This vulnerability, formally referred to as “Copy Fail,” affects kernel versions spanning nearly a decade, dramatically expanding its attack surface and posing a significant threat to millions of deployments.

It is tracked as CVE-2026-31431. Several security researchers emphasize that this issue is not only significant when it comes to privilege escalation, but also stands out for its operational simplicity, cross-environment portability, and high exploitation success rate factors, which all contribute to its elevated threat profile and explain why it has been classified as an actively exploited vulnerability. 

Upon reviewing these findings, the Cybersecurity and Infrastructure Security Agency (CISA) has formally escalated the issue by adding the flaw to its Known Exploited Vulnerabilities (KEV) catalogue, which indicates confirmed instances of exploitation across multiple Linux distributions in the wild. 

The weakness, rated CVE-2026-31431, has a CVSS score of 7.8, and is considered to be a local privilege escalation vulnerability (LPE), which permits an unprivileged user with local access to elevate privileges to root privileges. However, its long-lasting undetected status, combined with its reliable exploitation pathway, makes it an operational risk even greater despite its moderate scoring. 

Under the designation “Copy Fail,” security researchers at Theori and Xint first identified and analyzed this issue. The issue arises from the incorrect transfer of resources between security contexts within Linux kernels, which can be exploited to bypass standard privilege boundaries in Linux. 

Several kernel patches, including versions 6.18.22, 6.19.12, and 7.0, have been released in response to this vulnerability, which has been actively exploited. Federal guidance urges organisations to prioritize updating based on the active exploitation status of the vulnerability. Additionally, its unusually low barrier to exploitation and wide ecosystem impact reinforce the urgency surrounding the flaw. 

According to researchers, an exploit can be executed with as little as 732 bytes of code, which significantly reduces the threshold for abuse and extends its reach across virtually all major Linux distributions since 2017. 

Unprivileged local users are able to manipulate the kernel's in-memory page cache of readable files, including setuid binaries, at the core of the vulnerability. By doing so, executables may be modified at runtime without altering files on disk. Injecting malicious code into trusted binaries such as /usr/bin/su results in root-level permissions for execution. This technique creates a stealthy pathway to privilege escalation. 

The security analysts at Wiz have stated that this in-memory tampering fundamentally undermines traditional integrity assumptions, since the page cache serves as the live execution layer for binaries. Furthermore, this risk is compounded when deploying large-scale Linux-based applications in modern cloud or containerised infrastructures. 

According to Kaspersky's analysis, environments that leverage container technologies, such as Docker, LXC, and Kubernetes, may be particularly vulnerable to threats. By default, container processes may interact with the AF_ALG subsystem if the algif_aead module is present in the host kernel, thus expanding the attack surface and enhancing privilege escalation across boundaries. 

In a technical sense, the vulnerability originates from a logic flaw within the Linux kernel's cryptographic pipeline, specifically the authenticated encryption template ("authenc"), where incomplete handling allows memory interactions that were not intended. 

Essentially, the vulnerability allows a local, unprivileged user to trigger a controlled four-byte write primitive into any readable file's page cache—a capability which appears to be constrained, but which has severe security implications when applied to executable memory. 

A key component of the exploit chain is the AF_ALG interface, which exposes kernel cryptographic operations to user space, as well as the splice() system call, which is used to redirect data flows away from conventional buffers and into the GPU page cache. 

By manipulating the in-memory representation of executables, attackers can subtly modify their execution behaviour without changing files on disk; when these modifications target setuid-root executables, it is trivial to escalate privileges to the full set of privileges. An analysis of the root cause of the issue has revealed that this vulnerability was caused by a 2017 optimization introduced in the Linux kernel version 4.14 that enabled in-place buffer reuse to improve performance but weakened memory isolation guarantees by accident, creating the conditions for an exploit. 

Several distributions have been validated empirically by researchers, including Ubuntu 24.04 LTS, Amazon Linux 2023, Red Hat Enterprise Linux 10.1, SUSE Linux Enterprise 16, and Debian, all of which have demonstrated near-perfect reliability in a compact Python proof-of-concept. Since this flaw affects virtually all distributed operating systems released since 2017, it has drawn comparisons with previous high-profile flaws, including Dirty Pipe (CVE-2022-0847). 

However, Copy Fail is more portable across kernel versions, more reliable, and is simpler to exploit, as it does not require specific offsets or narrowly scoped configurations to operate. To resolve the issue, kernel maintainers reverted the underlying optimization and reintroduced safer buffer handling mechanisms as part of versions 6.18.22, 6.19.12, and 7.0 of the kernel. 

Despite the fact that major distributions have begun to deploy patched kernels, inconsistencies in advisory publication have caused friction in coordinated response efforts, resulting in security researcher Will Dormann noting that some platforms have issued updates that do not consistently mention CVE-2026-31431, potentially stalling remediation and risk awareness at an enterprise level. 

An additional technical analysis of the flaw has revealed a practical exploitation pathway, illustrating how attackers can operationalise the vulnerability systematically in real-world environments. An attacker typically begins the attack sequence by identifying a Linux host or container that runs on a vulnerable kernel version, followed by the preparation of an attack trigger based on Python tailored specifically for the target machine. 

Upon initiating the exploit, it can be executed either as a standard user on the host system or within a compromised container without elevated privileges utilizing a low-privilege context. By utilizing the underlying flaw, the exploit can overwrite the kernel page cache precisely by four bytes, corrupting sensitive data structures that are managed by the kernel and enabling privilege escalation. Ultimately, this allows the attacker to obtain unrestricted root access by elevating their process to UID 0.

As a result of the active threat landscape, Federal Civilian Executive Branch (FCEB) agencies have been instructed to resolve the vulnerability by May 15, 2026, in accordance with patches released by Linux distributions affected by this vulnerability. 

In the case that immediate patching is not feasible, interim mitigation strategies, including disabling vulnerabilities, segmenting networks, and tightening access controls, have been recommended as a means of reducing exposure and containing potential compromise paths. 

As a result of the active exploitation status of CVE-2026-31431, its extensive reach across the Linux ecosystem, and its relative ease of weaponisation, it serves as a critical reminder of the risks that are inherent to longstanding kernel-level design decisions. As a result of the convergence of high reliability, minimal exploit complexity, and broad distribution exposures, organizations are under increasing pressure to verify their patch postures and expedite remediation. 

As a precautionary measure, security teams should prioritize kernel updates, closely monitor privilege escalation activity, and reassess controls around multi-tenant and containerised environments in which attack surfaces may be heightened. 

Threat actors will continue to exploit low-friction exploitation paths for exploitation, which will require timely mitigation and disciplined system hardening to ensure operational integrity and limit the impact of these kernel vulnerabilities.
Read more »
Vietnam phishing campaign
AccountDumpling attack Cyber Attacks Facebook account hacking Google AppSheet phishing Vietnam phishing campaign

Vietnam-Linked “AccountDumpling” Campaign Exploits Google AppSheet to Hijack Thousands of Facebook Accounts

 


A newly uncovered cybercrime campaign linked to Vietnamese actors has been leveraging Google AppSheet as a phishing relay to send deceptive emails aimed at compromising Facebook accounts.

The operation, dubbed “AccountDumpling” by Guardio, revolves around stealing Facebook accounts and reselling them through illicit online marketplaces controlled by the attackers. Researchers estimate that nearly 30,000 accounts have been breached in this coordinated campaign.

"What we found wasn't a single phishing kit," security researcher Shaked Chen wrote in a report shared with The Hacker News. "It was a living operation with real-time operator panels, advanced evasion, continuous evolution and a criminal-commercial loop that quietly feeds on the same accounts it helps steal back."

This discovery highlights a broader trend of Vietnamese threat groups using increasingly sophisticated tactics to gain unauthorized access to Facebook accounts, which are later sold in underground markets for profit.

The attack chain typically begins with phishing emails sent to Facebook Business users, falsely posing as messages from Meta Support. These emails warn recipients that their accounts risk permanent suspension unless they submit an appeal. Notably, the emails originate from a legitimate-looking Google AppSheet address ("noreply@appsheet.com
"), helping them evade spam detection systems.

Victims are then directed to fraudulent websites designed to capture login credentials. Similar tactics were previously reported by KnowBe4 in May 2025.

In recent weeks, attackers have diversified their lures to trigger “Meta-related panic.” These include fake alerts about account bans, copyright violations, verification requests, job offers, and suspicious login activity. Guardio identified four primary attack patterns:
  • Phishing pages hosted on Netlify that mimic Facebook Help Center interfaces, collecting sensitive details such as birth dates, phone numbers, and ID documents, which are then transmitted to attacker-controlled Telegram channels.
  • Fake “blue badge” verification scams directing users through Vercel-hosted pages disguised as security checks, eventually harvesting credentials, business data, and two-factor authentication (2FA) codes.
  • Malicious PDF files hosted on Google Drive, posing as verification instructions, tricking users into submitting passwords, 2FA codes, ID images, and browser screenshots. These PDFs were created using a free Canva account.
  • Fraudulent job offers impersonating well-known brands such as WhatsApp, Adobe, Pinterest, Apple, and Coca-Cola to build trust and lure victims into further interaction on malicious platforms.
Across the first three attack clusters alone, associated Telegram channels were found to store around 30,000 victim records. Affected users span multiple countries, including the U.S., Italy, Canada, the Philippines, India, Spain, Australia, the U.K., Brazil, and Mexico, with many losing access to their accounts entirely.

Investigators traced part of the operation back to a Vietnamese individual after analyzing metadata embedded in the phishing PDFs, which listed the name “PHẠM TÀI TÂN” as the author. Further open-source investigation uncovered a website linked to this identity offering digital marketing services.

In a February 2023 post on X, the site’s account stated it "specializes in providing digital marketing services, marketing resources, and consulting on effective digital marketing strategies."

"Taken together, they form a consistent picture of a large, Vietnamese-based, mega operation," Chen said. "This campaign is bigger than a single AppSheet abuse. It's a window into the dark market around stolen Facebook assets, where access, business identity, ad reputation, and even account recovery have all become tradable commodities. Another entry in the pattern we keep surfacing: trusted platforms repurposed as delivery, hosting, and monetization layers."
Read more »
Lazarus Group
Cyber Attacks DeFi Platforms Financial Scam KelpDAO Lazarus Group

Lazarus Hackers Steal $290M from KelpDAO in Cross-Chain Exploit

 

KelpDAO has become the latest DeFi project to face a major security crisis after a $290 million heist that investigators say is likely tied to North Korea’s Lazarus Group. The attack targeted rsETH, a restaked ether asset used across several protocols, and drained about 116,500 tokens in a matter of hours. What makes the incident alarming is that the exploit did not appear to rely on a typical smart-contract flaw. Instead, it seems to have abused the project’s cross-chain verification setup, showing how a vulnerability in infrastructure can be just as damaging as a bug in code. 

According to the project’s public statement, KelpDAO detected suspicious cross-chain activity involving rsETH on April 18, 2026, and quickly paused rsETH contracts across Ethereum mainnet and Layer 2 networks. The team said it was working with LayerZero, Unichain, and other partners to investigate the breach and contain the damage. On-chain activity later showed that the stolen funds were moved through Tornado Cash, a common laundering route used to hide crypto theft. 

LayerZero’s early findings suggest the attack was highly coordinated. Researchers believe the hackers compromised RPC nodes and then used a DDoS campaign to force the system into failing over to poisoned infrastructure, where fraudulent cross-chain messages could be accepted as legitimate. In other words, the attackers appear to have tricked the bridge layer into believing a transfer had been properly authorized. That design weakness, rather than the asset itself, seems to have opened the door to the theft. 

The impact propagated quickly beyond KelpDAO. Because rsETH is accepted as collateral in lending markets, the exploit created risk for other DeFi platforms, including Compound, Euler, and Aave. Aave responded by freezing and blocking new deposits or borrowing using rsETH collateral. The wider market reaction highlights how one compromised bridge can ripple across multiple protocols, creating uncertainty far beyond the original target. 

The KelpDAO incident is another reminder that DeFi security depends not only on smart-contract audits, but also on the trust assumptions behind cross-chain systems. As protocols grow more interconnected, attackers need only find one weak link to trigger losses on a massive scale. For users and developers alike, the lesson is clear: layered security, diversified verification, and conservative bridge design are no longer optional.
Read more »
Stryker
Business Security Cyber Attacks Data Leak Medical Tech Stryker

Stryker Attack Wipes Thousands of Devices Without Malware

 

Stryker’s latest cyber incident is a stark reminder that attackers do not always need malware to cause major damage. The medical technology company said the breach was confined to its internal Microsoft environment and did not affect its products, including connected and life-saving devices, which remain safe to use. Even so, the attack disrupted business operations and forced customers to place orders manually while electronic ordering systems stayed offline. 

According to the report, the incident was not a ransomware attack, and Stryker emphasized that no malware was deployed on its systems. Instead, the threat actor appears to have used legitimate Microsoft Intune tools to remotely wipe devices after compromising an administrator account and creating a new Global Administrator account. That method made the attack especially dangerous because it relied on trusted enterprise controls rather than suspicious malicious software. 

The scale of the wipe was severe. A source familiar with the attack told BleepingComputer that nearly 80,000 devices were erased between 5:00 and 8:00 a.m. UTC on March 11. Employees across multiple countries reportedly woke up to find company-managed laptops and mobile devices wiped overnight. The group Handala, believed to be linked to Iran, claimed responsibility and said it had destroyed over 200,000 systems and stolen 50 terabytes of data, though investigators did not confirm those claims. 

What makes this case notable is that the attack appears to have used “living off the land” tactics, meaning the intruder abused legitimate administrative access rather than deploying custom code. That approach can be harder to detect because security tools often look for malware signatures or known exploit behavior, not authorized commands executed by a compromised admin account. The result is a fast, high-impact disruption that can spread across a corporate fleet in hours. 

For enterprises, the Stryker case reinforces the need for stronger identity protection, tighter administrator controls, and better monitoring of cloud management platforms. Privileged access should be minimized, account creation should be closely audited, and wipe capabilities should require strong checks before execution. In this incident, the attacker did not need an exploit or a virus; a stolen credential and a legitimate tool were enough to cripple a large organization.
Read more »
Hacker attack
Cyber Attacks Cyber crimes Cyber Extortion cybercrime gangs CyberSecurity Ransomware Attacks Hacker attack

Rival Ransomware Gangs 0APT And Krybit Clash In Unusual Cyber Extortion Battle

 

A clash almost unseen among digital outlaws has begun - 0APT, a hacking collective, now warns it will unmask operatives from enemy faction Krybit. This shift came to light through surveillance of hidden online forums. Tension simmers beneath the surface of these underground circles. Rival gangs once operating in parallel seem to fracture under pressure. Trust, usually scarce, is vanishing faster than usual. Evidence points toward escalating friction inside ransomware communities. 

What began as covert threats may reshape alliances unexpectedly. Reports indicate 0APT sent a threat to Krybit, insisting on payment under risk of exposing private records - names, positions, operational files - if ignored. A limited set of claimed stolen materials was published shortly after, serving as evidence - a move mirroring classic dual-pressure methods seen in attacks on businesses. Yet using such an approach toward another illicit network stirs doubt around its real impact, given that public image matters little within hidden communities. 

Even so, the danger remains somewhat real. Because cybercrime networks depend on staying hidden, revealed identities might invite legal trouble or revenge attacks. From the exposed information, security analysts pulled login details tied to Krybit members - alongside digital currency wallets - hinting at weak points in how the group functions. Yet the full impact stays unclear. Now showing a blank page, Krybit's site now displays only a standard upkeep notice, hinting at disruptions tied to recent events. Little is known about the collective so far, mainly because big security analysts have published almost nothing on them - possibly a sign they are just beginning operations. 

On the opposite end, 0APT emerged around spring 2026 and gained attention fast, marked by complex tools and methods, even though some doubt surrounds how truthful their early reports of breaches really were. Odd as it seems, infighting among hackers has happened before. Earlier clashes included DragonForce going after opponents - BlackLock, then Mamona - by altering web pages and exposing private messages. 

In much the same way, activity aimed at RansomHub tied back to DragonForce, revealing ongoing friction between ransomware crews. This conflict taking shape between 0APT and Krybit signals changes in how cybercriminals operate - motives like money, dominance, and competition now spark open clashes. With ransomware networks evolving fast, these kinds of face-offs might happen more often, making it harder for security experts to follow the players involved.
Read more »
UAE Firms
AI Attacks AI tools Business Security Cyber Attacks UAE Firms

UAE Businesses Warned of Escalating AI‑Powered Cyber Threats

 

UAE businesses are being urgently warned about a sharp rise in AI‑powered cyber threats that can compromise systems within hours, and sometimes even minutes, if organisations remain unprepared. Cybercriminals are increasingly using artificial intelligence to craft highly realistic phishing emails, deepfake voice and video impersonations, and automated attacks that exploit gaps in security before teams can respond. 

Nature of AI‑driven threats 

Attackers are leveraging generative AI to personalize scams at scale, including cloned emails, synthetic voices, and fake video calls that mimic senior executives or partners. These AI‑enabled methods make spear‑phishing and impersonation fraud far more convincing, increasing the chances that employees will authorise fraudulent transfers or share sensitive credentials. 

AI tools now allow adversaries to perform reconnaissance, scan for vulnerabilities, and launch password‑guessing and ransomware attacks in a fraction of the time it once took. Security experts note that many organisations now face same‑day compromises, where attackers move from initial access to data theft or system encryption within a single business day.

Impact on UAE firms and the economy 

The UAE’s role as a regional financial and technology hub makes it a prime target for state‑backed and criminal hacking groups that use AI to intensify their campaigns.Breaches can lead to substantial financial losses, reputational damage, regulatory penalties, and disruption of critical services, especially as digital‑government and smart‑city initiatives expand.

Cyber professionals recommend continuous staff training on spotting AI‑powered phishing and impersonation, tightening access controls, securing machine identities, and maintaining tested incident‑response and recovery plans. With AI adoption accelerating across industries, firms that act quickly to strengthen cyber resilience will be better positioned to withstand the next wave of AI‑enhanced cyber threats in the UAE.
Read more »
government breach
AI Hacking ChatGPT Claude AI Cyber Attacks government breach

AI-Driven Hack Breach Hits Government Agencies

 

A lone attacker reportedly used Claude and GPT-4.1 to breach nine Mexican government agencies, exposing data tied to 195 million citizens and showing how generative AI can accelerate cybercrime. The incident, which ran from December 2025 to February 2026, is a stark warning that AI can now amplify a single operator into something closer to a full attack team. 

Between late 2025 and early 2026, the attacker used Claude Code to carry out about 75% of remote commands during the intrusion. Researchers found 1,088 prompts across 34 active sessions, which led to 5,317 AI-executed commands on live victim systems. That level of automation meant the attacker could move through government networks far faster than a human-only workflow would allow.

The operation did not rely on one model alone. When Claude encountered limits, the attacker turned to ChatGPT for help with lateral movement, credential mapping, and other technical steps that supported the breach. A custom 17,550-line Python script then funneled stolen data through OpenAI’s API, generating 2,597 structured intelligence reports across 305 internal servers. 

The stolen material reportedly included tax records, voter information, employee credentials, and other sensitive government data. Beyond the scale of the theft, the bigger problem is what this means for defense teams: AI can shorten the time needed to find weaknesses, write exploits, and organize stolen data. That compression makes traditional detection and response windows much harder to meet. 

This case shows that cybercriminals no longer need large teams to mount sophisticated operations. With the right prompts, a single attacker can use commercial AI systems to plan, automate, and scale an intrusion in ways that were once reserved for advanced groups. Anthropic said it investigated, disrupted the activity, and banned the accounts involved, but the broader lesson is clear: security defenses now need to account for AI-accelerated attacks as a mainstream threat.
Read more »
Healthcare Cyber Attack
ChipSoft ransomware attack Cyber Attacks Cyber Security Ransomware Attacks cybersecurity in healthcare Healthcare Healthcare Cyber Attack

ChipSoft Ransomware Incident Disrupts Dutch Healthcare Systems And Hospital Operations

Early in April, a ransomware incident struck ChipSoft, a Dutch firm supplying healthcare software. Hospitals relying on its systems faced major interruptions. Some had to go offline - cutting access to essential tools. Instead of regular operations, backup plans took over. When providers like ChipSoft fall victim, ripple effects hit care delivery hard. This event highlights how vulnerable medical networks can be through supplier weak points.  


After the event, Z-CERT - the Dutch agency for health sector cyber safety - has coordinated alongside ChipSoft and impacted facilities to evaluate risks, share actionable insights, meanwhile aiding restoration steps. Updates are still being tracked while medical services adapt to disruptions unfolding across systems. To prevent further risk, ChipSoft blocked entry to major platforms like Zorgportaal, HiX Mobile, and Zorgplatform. 

Because hospitals rely on these tools for handling medical records and daily operations, the outage caused serious disruptions. Service recovery is now unfolding step by step, with fresh login details being sent out alongside updates. Among affected sites, 11 hospitals cut access to ChipSoft tools mid-operation - network disconnection became a fast response. Connections through protected vendor-linked tunnels faced shutdowns on guidance from cybersecurity teams. 

Though halting some digital pathways slowed danger spread, care routines stumbled briefly at various locations. Outages hit multiple medical centers - Sint Jans Gasthuis, Laurentius Hospital, VieCuri Medical Center, and Flevo Hospital among them. Even so, treatment did not break down. Extra staff appeared at support stations because digital tools failed. Phone lines opened wider under pressure. When systems went quiet, people stepped in, swapping screens for spoken updates. Care moved forward, hand over hand. 

So far, officials report uninterrupted critical healthcare operations, thanks to workable backup strategies reducing disruption. While probes continue, nothing yet points to leaked personal health records. Still, monitoring remains active across systems. Still unknown is who launched the attack, yet no known ransomware collective has stepped forward. At times throughout recovery efforts, access to ChipSoft’s internal platforms - including its public site - was blocked, showing how deep the impact ran. 

From within the supplier’s infrastructure the compromise likely began, which triggered protective steps among client organizations. Security worries after the breach have slowed things down elsewhere too. Though planned earlier, rolling out the updated patient records software at Leiden University Medical Center now faces postponement - ChipSoft’s system caught in the ripple effects. 

This occurrence underscores an ongoing pattern in digital security: hospitals continue facing heightened risks because disruptions to care carry serious consequences, demanding swift fixes. When core technology suppliers suffer breaches, ripple effects spread through interconnected systems, worsening damage far beyond one location. 

Still working through recovery, teams from Z-CERT alongside medical facilities aim to bring systems back online without harming patient services. Because of the ChipSoft ransomware event, attention has shifted toward building tougher defenses, spotting threats earlier, with more reliable safeguards woven into health sector networks.
Read more »
macOS
AI Chatbot AI Security Axios ChatGPT. OpenAI Cyber Attacks Digital Supply Chain Risk macOS

OpenAI Tightens macOS Security After Axios Supply Chain Attack and Physical Threat Incident

 

Security updates rolled out by OpenAI for macOS apps follow discovery of a flaw tied to the common Axios library. Because of risks exposed through a software supply chain breach, checks on app validation tightened noticeably. One outcome: stronger safeguards now guide distribution methods across desktop platforms. Verification steps increased where imitation attempts once slipped through. The company says the hacked Axios package entered a dev process via an automated pipeline, possibly revealing key signing methods tied to macOS app authentication. 

Though worries emerged over software trustworthiness, OpenAI stated no signs exist of leaked user information, breached internal networks, or tampering with its source files. Starting May 8, older versions of OpenAI’s macOS apps will no longer be supported. Updates are now mandatory, not optional. The shift pushes users toward newer releases as a way to tighten defenses. Functionality depends on using recent builds - this cuts openings for tampering. Fake or modified copies become harder to spread when outdated clients stop working. 

Security improves when only authenticated software runs. Protection rises when unverified versions fade out. Keeping systems current closes gaps exploited by malicious actors. Outdated installations pose higher risk, so access ends automatically. Upgraded versions meet stricter validation standards. Support withdrawal isn’t arbitrary - it aligns with safety priorities. 

Continued operation requires compliance with updated requirements. It could be part of a broader pattern - security incidents tied to groups connected with North Korea have recently focused on infiltrating software development environments through indirect routes. Instead of breaking into main platforms, attackers often manipulate components already trusted within workflows. This shift toward subtle intrusion methods has made early identification more difficult. Detection lags because weaknesses hide inside approved tools. 

One sign points to coordinated efforts stretching across multiple targets. The method avoids obvious entry, favoring quiet access over force. Compromised updates act like unnoticed messengers. Such strategies thrive where verification is light. Hidden flaws emerge only after deployment. Trust becomes the weak spot. Observers note similar tactics appearing elsewhere in recent breaches. Indirect pathways now draw more attention than frontal assaults. Stealth matters more than speed. Systems appear intact until downstream effects surface. Monitoring grows harder when threats arrive disguised as normal operations. 

Besides digital safety issues, OpenAI now faces growing real-world dangers. In San Francisco, law enforcement took someone into custody after a suspected firebomb was thrown close to Chief Executive Sam Altman’s home, followed by further warnings seen near corporate offices. Though nobody got hurt, the events point to rising friction tied to artificial intelligence development. OpenAI collaborates with authorities, addressing risks across online and real-world domains. Strengthening internal safeguards remains an ongoing effort, shaped by evolving challenges. 

Instead of waiting for incidents, recent steps like requiring updated macOS versions aim to build confidence in their systems. This move comes before any verified leaks occur - its purpose lies in prevention, not damage control. OpenAI pushes further into business markets right now, with growing income expected from ad tech powered by artificial intelligence along with corporate offerings. 

At the same time, efforts such as the “Trained Access for Cyber” project move forward, delivering advanced cybersecurity tools driven by machine learning to carefully chosen collaborators. Still, the event highlights how today's cyber threats are becoming harder to manage, as flaws in shared software meet tangible dangers in practice. 

Notably, OpenAI’s actions follow a wider trend across tech - companies now prioritize tighter checks, quicker updates, sometimes reworking entire defenses before problems spread.
Read more »
exploitable flaws
AI Chatbot AI Security AI security flaw AI technology Anthropic Anthropic AI Cyber Attacks exploitable flaws

Anthropic AI Cyberattack Capabilities Raise Alarm Over Vulnerability Exploitation Risks

 

Now emerging: artificial intelligence reshapes cybersecurity faster than expected, yet evidence from Anthropic shows it might fuel digital threats more intensely than ever before. Recently disclosed results indicate their high-level AI does not just detect flaws in code - it proceeds on its own to take advantage of them. This ability signals a turning point, subtly altering what attacks may look like ahead. A different kind of risk takes shape when machines act without waiting. What worries experts comes down to recent shifts in how attacks unfold. 

One key moment arrived when Anthropic uncovered a complex spying effort. In that case, hackers - likely backed by governments - didn’t just plan with artificial intelligence; they let it carry out actions during the breach itself. That shift matters because it shows machine-driven systems now doing tasks once handled only by people inside digital invasions. Surprisingly, Anthropic revealed what its newest test model, Claude Mythos Preview, can do. The firm says it found countless serious flaws in common operating systems and software - flaws that stayed hidden for long stretches of time. Not just spotting issues, the system linked several weaknesses at once, building working attack methods, something usually done by expert humans. 

What stands out is how little oversight was needed during these operations. What stands out is how this combination - spotting weaknesses and acting on them - marks a notable shift. Not just incremental change, but something sharper: specialists like Mantas Mazeika point to AI-powered threats moving into uncharted territory, with automated systems ramping up attack frequency and reach. Another angle emerges through Allie Mellen's observation - the gap between detecting a flaw and weaponizing it shrinks fast under AI pressure, cutting response windows for companies down to almost nothing. Among the issues highlighted by Anthropic were lingering flaws in OpenBSD and FFmpeg - examples surfaced through the model’s analysis - alongside intricate sequences of exploitation targeting Linux servers. 

With such discoveries, questions grow about whether current defenses can match accelerating threats empowered by artificial intelligence. Now, Anthropic is holding back public access entirely. Access goes only to a select group of tech firms through a special program meant to spot weaknesses early. The move comes as others in tech worry just as much about misuse. Safety outweighs speed when the stakes involve advanced systems. Still, experts suggest such progress brings both danger and potential. Though risky, new tools might help uncover flaws early - shielding networks ahead of breaches. 

Yet success depends on collaboration: firms, officials, and digital defenders must reshape how they handle code fixes and protection strategies. Without shared initiative, gains could falter under old habits. Now shaping the digital frontier, advancing AI shifts how threats emerge and respond. With speed on their side, those aiming to breach systems find new openings just as quickly as protectors build stronger shields. Staying ahead means defense must grow not just faster, but smarter - matching each leap taken by adversaries before gaps widen.
Read more »
Healthcare Cyber Attack
ChipSoft ransomware attack Cyber Attacks cybersecurity in healthcare CyberSecurity Ransomware Attacks Healthcare Cyber Attack

ChipSoft Ransomware Attack Disrupts Dutch Healthcare Systems and HiX EHR Services

 

A sudden cyberattack targeting ChipSoft triggered widespread interruptions in essential health IT operations throughout the Netherlands, leading officials to isolate key network segments. While public access tools went down, medical staff also lost functionality within core administrative environments - prompting urgent questions around resilience under pressure and protection of sensitive records. 

Because of the cyberattack, ChipSoft shut down multiple services such as Zorgportaal, HiX Mobile, and Zorgplatform to limit possible damage. Hospitals across the nation rely on ChipSoft's main system, HiX, making it a key player in digital medical records. As a result, clinics received warnings urging them to cut connections to ChipSoft platforms until safety is confirmed. Preventive steps like these aim to reduce risks while experts handle the breach. 

Later came confirmation via local news outlets, following early signals from public posts on the web. A company-issued message raised concern, citing signs of intrusion into operational systems. This notice hinted at data exposure without confirming full compromise. Not long afterward, official classification arrived: Z-CERT labeled it a ransomware event. Coordination across impacted health entities started under their guidance. Outages began spreading through several hospitals after the incident unfolded. Sint Jans Gasthuis in Weert felt effects early, followed by disruptions at Laurentius Hospital in Roermond. Digital tools slowed down or stopped working altogether at VieCuri Medical Center in Venlo. 

Flevo Hospital in Almere also saw restricted system availability soon afterward. Even though certain departments kept running, performance gaps between locations revealed deeper weaknesses. When cyber incidents strike, medical technology networks often struggle more than expected. Healthcare tech firms often serve many hospitals at once, making them prime targets for ransomware attacks. 

When one falls victim, consequences tend to ripple through linked facilities without warning. Patient treatment slows down, daily operations stumble, records become unreachable. Despite mentioning efforts to reduce harm, ChipSoft has shared little about what information might be exposed. Confirmation on how deep the breach goes remains absent so far. After this event came several earlier breaches across medical tech companies worldwide - proof of rising exposure. 

With hospitals shifting more operations online, criminals now zero in on those holding vast amounts of vital data. Sometimes it's not about speed but access; value draws attention over time. Systems once isolated now face constant probing from distant actors watching for gaps. Right now, work continues to regain control - officials alongside digital defense units are measuring harm while bringing services back online. 

This breach by ChipSoft highlights once more how vital strong cyber protections are within medical infrastructure, since short outages might lead to severe outcomes beyond screens.
Read more »
SOHO router security
Cyber Attacks DNS hijacking threat Fancy Bear cyberattack Forest Blizzard hackers Microsoft router attack SOHO router security

Microsoft Warns of Russian-Linked Router Attacks Escalating Into Cloud Service Breaches

 

Cybercriminals have long targeted poorly secured routers in personal and small office/home office (SOHO) environments, but a newly uncovered campaign has taken this threat to another level. According to Microsoft, attackers are no longer limiting themselves to device compromise—they are now leveraging these breaches to infiltrate widely used cloud platforms.

A well-known Russian state-backed hacking group, Forest Blizzard—also tracked as Storm-2754 or Fancy Bear—has once again been identified targeting internet-facing devices. The group has spent recent months attempting to infiltrate thousands of personal and SOHO routers. Once access was obtained, the attackers used these devices as stepping stones for broader cyber operations.

Insights from Microsoft’s Threat Intelligence team reveal that the campaign has been active since at least August 2025. During this period, Forest Blizzard conducted widespread attacks on thousands of routers, impacting over 200 organizations and approximately 5,000 consumer devices. A key tactic involved altering DNS configurations on compromised routers, allowing attackers to maintain persistent access and monitor DNS traffic.

Microsoft analysts noted that the group used hijacked routers to reroute internet traffic through malicious DNS infrastructure. This setup enabled more advanced man-in-the-middle operations—referred to as adversary-in-the-middle attacks—targeting Microsoft 365 services. In these attacks, fraudulent DNS servers could deliver invalid TLS certificates, which many users ignored as routine browsing issues. Without proper encryption, attackers could intercept unprotected web traffic and extract sensitive Microsoft 365 data.

Such MiTM/AiTM attacks can expose critical account credentials, potentially compromising large organizations and strengthening the attackers’ ongoing campaigns. The stolen data could also be used to launch further cyberattacks, including malware deployment or denial-of-service disruptions.

Microsoft has outlined several mitigation strategies for both individuals and enterprises. Modern Windows systems now include protections against DNS hijacking, such as Zero Trust DNS and enhanced safeguards within Microsoft Defender. The company’s security tools are designed to identify activity linked to Forest Blizzard / Storm-2754 and alert users in real time.

For organizations, additional layers of defense—such as Entra ID Protection and multi-factor authentication—are strongly recommended. Businesses are also advised to avoid relying on home routers within corporate networks. Instead, remote and hybrid work environments should be secured through centralized identity management systems to reduce exposure to such threats.
Read more »
Subscribe to: Posts (Atom)