Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Cyber Security. Show all posts
infostealer malware surge
AI Models AI Risks AI technology Cyber Security cybercriminals Data protection data stealing Doxing infostealer malware surge

Volta-Autodoxer Malware Uses Artificial Intelligence to Rank Victims and Build Detailed Personal Dossiers

 

Cybersecurity researchers at Cisco Talos have uncovered a new piece of malware known as Volta-Autodoxer (VOLTA) which uses commercial AI models to analyse the data it steals from Windows systems, identifying the most valuable targets. This shows that AI technology is now increasingly being used inside malware to automate processes. 

While traditional infostealers will steal sensitive data from infected systems such as saved passwords, browser cookies, payment card details, crypto wallet recovery phrases, authentication tokens and cloud credentials, the attacker often has to manually search through large amounts of data to identify valuable targets. Volta aims to cut this out using automated analysis of the victims data on the infected system. 

During the data collection phase, the malware will collect credentials, session data, Wi-Fi profiles, SSH keys, Microsoft OAuth tokens and screenshots of the desktop. It will also target Discord, Telegram, Steam and Roblox accounts to collect active session and account data. It will then use the stolen session tokens to access the victims main email accounts. This includes Gmail and Outlook. It will look at purchase confirmations and order history on services like Amazon, UberEats, DoorDash and Grubhub. This can give an insight into the victims home address, shopping habits, daily routines, work details and other personal information. It can also look up third-party services such as Rolimons to determine the resale value of their Roblox items. 

The malware will then organise the data it has collected and send it to OpenRouter, an API gateway that allows access to multiple AI models. The prompt inside the malware will tell the language model to act as a forensic intelligence analyst. It will create a detailed report on the victims and will identify if they could be valuable financially and how good their operational security is. The malware will use Anthropic’s Claude Opus 4.6 model by default. However, the developers have considered that there may be AI safety measures in place preventing the creation of malicious reports. 

The malware will look for rejection phrases such as 'I can’t’ in the models responses and switch to another provider if the request is denied. It will switch to Moonshot AI’s Kimi K2 and Google’s Gemini 2.5 Flash. Once the report has been created, the malware will package the stolen data and AI report into ZIP files. These will be sent directly to the attackers via a Telegram channel. Files will be named things like volta_dox.zip. The malware was discovered by Cisco Talos during their research using the CAIRN research framework. 

The builder also has configurable fields suggesting that this malware may have been designed to be distributed or sold to other cybercriminals. While it has not been seen widely in the wild, it shows how AI can be used to help attackers target victims more effectively by automatically creating profiles. This makes the personal information stolen more useful for targeted cybercrime.
Read more »
Google
AI ai agents Cyber Security DeepMind Google

Google DeepMind AI Agents Reduce the Cost of Attacking 1024-Bit RSA Encryption


Artificial intelligence (AI) agents developed by Google DeepMind have shown new ways to make attacks against legacy RSA-1024 encryption systems significantly cheaper. 

The research was conducted by Google DeepMind in collaboration with cryptography researchers from the University of California San Diego and Inria. 

RSA is a widely used public-key cryptographic algorithm that relies on the mathematical difficulty of factoring large numbers. Although RSA-1024 was once considered sufficiently secure, advances in computing and cryptanalysis have made it unsuitable for protecting sensitive information. Modern systems generally use RSA keys of 2048 bits or longer.

The first major finding focused on digital signature forgery involving the PKCS#1 v1.5 padding format. Padding is additional data inserted into a message before signing to ensure that it meets the required block size. Researchers examined how this protection behaves when an attacker can influence the content of the message being signed.

The team found that when an attacker controls approximately half or more of the signed data block, the padding may no longer provide additional protection against forgery. This weakness is relevant to the PKCS#11 signing interface used by cryptographic devices, including hardware security modules.

To show the improvement, DeepMind's AI agents reproduced an earlier academic signature-forgery attack against an RSA-1024 key. The agents reduced the required computing time from approximately 1,380 CPU core-years to 391 CPU core-years, making the process around 3.5 times more efficient.

Two AI agents reportedly designed, executed and debugged the computation in less than four days, with approximately 20 messages from a human researcher, most of which involved approving their actions.

Researchers also developed a more efficient approach for situations where attackers control a smaller portion of the signed message, such as a 32-byte hash. Their theoretical calculations suggest that the proposed method could be approximately 1,600 times more efficient than the previous best approach for certain RSA-1024 signature-forgery scenarios.

The second major finding concerns RSA key factoring. RSA security depends on the difficulty of breaking down a large number into its original prime factors. The researchers developed an algorithm that could make factoring each additional RSA-1024 key approximately 30 times cheaper on average after an expensive initial computation.

However, this technique remains theoretical and has not yet been implemented. The initial computation would also require substantial resources, meaning the findings do not show an immediate practical attack against deployed encryption systems.

The researchers also highlighted important limitations of the signature-forgery technique. It requires approximately four billion signing queries in advance, does not recover the private key and does not work against devices that internally hash messages before signing.

According to Pushmeet Kohli, Vice President at Google DeepMind and Chief Scientist at Google Cloud, modern cryptographic protocols generally use RSA keys of 2048 bits or larger and remain secure against the demonstrated techniques.

Read more »
Hacker attack
Anti Malwares Cyber Security Developer Security GitHub GitHub malware Hacker attack

Hackers Infiltrate GitHub Projects to Infect Cybersecurity Developers With Advanced Malware

 

Cybercriminals are distributing malware through GitHub repositories designed to look like genuine development projects. Researchers at Doctor Web found malicious code in Microsoft Visual Studio projects, Python scripts and Go files. Over 2000 computers were reportedly infected with this malware. The campaign began around 2 years ago with the initial targets being cryptocurrency users. The repositories were themed around blockchain games, game bots and cheating tools. 

The repositories even included guidance for installing Visual Studio to make them seem more legitimate to less experienced developers. However the malware has now targeted information security professionals. The malicious code is hidden within repositories that claim to be for automated scanning, security testing and log analysis. The infected files have malicious code hidden in the configuration and source code of the repository. The malicious code is hidden with lots of white space. 

When the malicious project is downloaded, it runs PowerShell scripts that fetch further malicious files from external sources. This results in an archive being downloaded containing Microsoft.exe, which is a malware loader built with Electron. The malware has been identified as Trojan.Loader.3261. Once active, the malware gathers information about the system, creates persistence and downloads further payloads. It also tries to disable Windows Defender, User Account Control, alerts and recovery features. 

The malware uses various methods to avoid being monitored by security tools, hijack legitimate windows processes and avoid detection from endpoint detection systems. The malware includes payloads such as BackDoor.AsyncRAT.115 which allows the attacker to remotely access the infected computer. It also includes Trojan.InjectNET.14 which adds a cryptocurrency hijacker to the clipboard. This changes the copied wallet addresses to ones controlled by the attacker. 

It also takes screenshots of the infected system. The malware also includes JS.Stealer.191 which steals information from browsers, VPNs, messaging applications, gaming accounts, FileZilla and Discord. This information is zipped up and sent to the attacker via a Telegram bot. The malware tries to uninstall security tools from ESET, McAfee and Malwarebytes. It also changes the hosts file in windows to prevent access to certain anti virus domains. 

The researchers found multiple variations of how the malware was deployed. They also found other incomplete components which indicates that the malware is still being developed. Future features could include auto reinstall, better persistence, managing applications when they open and updating software. This shows that even information security professionals can be vulnerable to malicious resources. The researchers recommend checking any files you download, keeping anti virus databases up to date and being cautious when cloning unknown GitHub repositories.
Read more »
Email Security Getaways
Barracuda Bypass Flaw Critical Vulnerability Cyber Security Email Security Getaways

Barracuda Patches Two Security Flaws That Could Let Attackers Take Over Email Security Gateways


Experts have shown how two vulnerabilities in Barracuda's Email Security Gateway can be chained to execute arbitrary commands with root privileges without requiring an attacker to log in.

The vulnerabilities, tracked as CVE-2026-116606 and CVE-2026-111560, affect Barracuda's email-filtering appliance and could allow remote attackers to bypass security restrictions and gain complete control of vulnerable systems.

According to cybersecurity firm watchTowr, which published its technical analysis, the attack chain combines an authorization bypass flaw with a command injection vulnerability. Barracuda released security patches for the issues earlier this week.

The first vulnerability, CVE-2026-116606, is an authorization bypass flaw that allows unauthenticated attackers to access a configuration restoration function and modify the appliance's global settings. The second, CVE-2026-111560, is a command injection vulnerability that enables commands to execute with root privileges.

Mandiant assigned CVSS severity scores of 9.3 and 8.6 to the two vulnerabilities, respectively.

How the attack chain works

In its technical investigation, watchTowr discovered that the authorization bypass stems from the appliance's password-change process. When a password change request fails, the system incorrectly returns a low-privilege user role instead of terminating the request completely.

The researchers also found that Barracuda's backup verification mechanism relies on a secret embedded within the appliance's code. Since this secret is not securely protected, attackers can generate a valid checksum for a specially crafted configuration backup and restore it on the targeted device.

The uploaded configuration can contain a manipulated timezone value. When the appliance processes this setting, it passes the value to a shell command that executes with root privileges.

watchTowr demonstrated the attack by successfully writing a file to the appliance with root-level permissions.

Affected products

CVE-2026-116606 affects Barracuda Email Security Gateway, while CVE-2026-111560 impacts five additional products, including Load Balancer Application Delivery Controller (ADC), Message Archiver, WAF Control Center, Web Application Firewall (WAF), and Web Security Gateway (WSG).

However, the complete unauthenticated attack chain applies specifically to Email Security Gateway. Exploitation of the command injection vulnerability on the other affected products requires administrator access.

What next?

Barracuda has released security updates addressing both vulnerabilities and recommends that customers install the appropriate patches or upgrade to the latest fixed firmware versions.

As of the disclosure, neither vulnerability had been listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, and no publicly reported incidents linked the flaws to active exploitation.

Read more »
RBI Data Centre
AI Security Banking Security Cyber Security cybersecurity risks Cybersecurity Training Institute data sovereignty Digital Banking Financial Cybersecurity India's Digital Infrastructure RBI Data Centre

Data Sovereignty Is Essential for India's Digital Infrastructure, Says RBI Governor


Sanjay Malhotra, Governor of the Reserve Bank of India (RBI), emphasized the significance of maintaining sovereign data centers in order to safeguard critical financial information and strengthen the country's digital infrastructure. As information technology has become an integral part of the banking industry, security infrastructure, operational resilience, and cybersecurity have become increasingly important in maintaining financial stability, especially in light of the growing threat landscape being shaped by artificial intelligence (AI). 


Prime Minister Narendra Modi inaugurated the RBI's new data center complex and Cybersecurity Training Institute in Bhubaneswar on October 25, and made these remarks following the inauguration. With a capital investment of Rs 169 crore, the facility is expected to enhance the reliability of critical financial services and to reduce the likelihood that essential banking operations will be disrupted.

A spokesperson for Doordarshan reported that Malhotra explained that the central bank's technology infrastructure facilitates the use of applications by the general public, financial institutions, and government departments. He pointed out that information technology cannot be considered merely a supporting function, as several essential financial operations are directly dependent upon the availability and security of these technologies. 

NEFT and RTGS are major payment infrastructures that will be supported by the new data center. Furthermore, the RBI's integrated ombudsman system and applications used by financial institutions regulated by the central bank will be supported by the new data center. In addition to government banking operations, it will also accommodate financial institutions regulated by the RBI. 

A key component of Malhotra's statement was the RBI's role in the Unified Payments Interface (UPI) ecosystem in India. Although UPI is operated by the National Payments Corporation of India (NPCI), final settlement of transactions takes place through the RBI's data centres and applications. To ensure the availability of the central bank's infrastructure within the wider digital payments ecosystem, it is important. 

Four independent data centres are located within the Bhubaneswar complex, which has been accredited as Tier IV by the Uptime Institute, the highest level of its data centre classification. This facility will be operated independently of third party cloud service providers, allowing RBI to maintain greater control over its critical infrastructure and sensitive financial information. Additionally, the project's geographical location will contribute to its resilience. 

A geographically separated and seismically isolated location in Bhubaneswar reduces the possibility that a localised disruption will affect all facilities simultaneously. The RBI previously operated three data centers in Maharashtra. Additionally, this development reflects the increasing importance of data sovereignty in the Indian financial infrastructure, where uninterrupted access to critical systems and the control of sensitive information remain essential security priorities. 

As part of the RBI's infrastructure security efforts, cybersecurity expertise is also being developed throughout the financial sector. In the Bhubaneswar project, there will be a Cybersecurity Training Institute, which will occupie approximately two-thirds of the campus, and the remaining portion will accommodate the data centre. It is intended that the institute will provide training to personnel of the RBI, bank employees, and professionals from other financial institutions. 

A number of emerging technologies, such as artificial intelligence (AI), big data analytics, quantum technology, and blockchain, will be studied as part of its programming. There will also be research activities conducted in order to investigate ways to improve the security and efficiency of financial systems. With AI posing new challenges to financial institutions, specialized training is becoming increasingly important.

The technology can provide opportunities for improving banking operations and security monitoring; however, if it is misused, it can result in cyberattacks, automated fraud, and attempts to exploit weaknesses in digital systems, increasing in sophistication. Financial sector readiness therefore relies heavily on cybersecurity professionals staying up to date on these developments. 

Governor of the Reserve Bank, Sanjay Malhotra, stressed the need to maintain personnel informed of technological developments and the growing importance of cybersecurity in the context of artificial intelligence. By attending the institute, financial sector professionals will be better equipped to comprehend emerging risks and respond to changes in cybersecurity. In addition to investing in digital infrastructure, the initiative emphasizes the importance of building human expertise. 

For data centers and advanced technology systems to be secure, trained professionals must manage operations, identify security weaknesses, and ensure service reliability are required. It was pointed out during the inauguration that cybersecurity was directly related to India's economic security by Prime Minister Narendra Modi. As financial services become increasingly dependent on digital technologies and digital banking, it becomes increasingly important to protect the financial infrastructure.

As well as highlighting the institute's role in developing cybersecurity and emerging technologies, Finance Minister Nirmala Sitharaman also highlighted the institute's efforts. Due to its emphasis on energy efficiency and water conservation, the RBI has also applied for a Platinum rating with the Indian Green Building Council. 

Bhubaneswar represents a larger effort to strengthen India's control over critical financial technology infrastructure by incorporating locally sourced materials in its construction approach. To protect the country's financial ecosystem, sovereign data management, geographically distributed infrastructure, and specialized cybersecurity training will remain important. As digital payments and artificial intelligence-driven services continue to increase, a comprehensive data management system, geographically distributed infrastructure, and cybersecurity training will be essential. 

An important strategic investment is being made in Indian financial infrastructure with the establishment of the sovereign data centre and cybersecurity training institute. In order to enhance the long-term reliability and resilience of the country's digital financial systems, the RBI intends to strengthen control over critical financial data and develop specialised cybersecurity expertise.
Read more »
fake remote tech jobs
AI Deepfakes AI Powered Scams AI Risks AI technology AI Voice Scam Cyber Security Cyberscams deepfake scams fake remote tech jobs

AI-Powered CEO Impersonation Scheme Allegedly Defrauded Companies of $129 Million

 

Three men have been indicted in the United States for an alleged international fraud scheme in which they used artificial intelligence to impersonate corporate executives and legal professionals to trick employees into sending around $129 million to their accounts. 

Jacob Soall, Sharon Hazan and Guy Sheetrit have been charged with pretending to be company CEOs and lawyers to convince employees that large transactions were needed. Between 2024 and 2026, the trio allegedly conspired to use AI to create fake audio and video of real people, according to the U.S. Department of Justice. They used AI to make their impersonations realistic enough to fool corporate workers. 

The trio now face numerous charges including wire fraud, money laundering and aggravated identity theft. If they are found guilty, they could face a maximum sentence of 104 years in prison. They called employees and pretended to be their company’s chief executive, with the alleged fraudsters claiming they needed urgent financial transactions to be completed and that it was confidential. They would then tell employees to contact lawyers on behalf of the company. 

AI was used to create copies of the lawyers’ voices and appearances. Soall was reported to have taken on the role of impersonating lawyers and had scripts ready to mimic how they would speak. Once they had convinced employees to approve the transactions, the money was sent through bank accounts in the United States, Europe, the United Arab Emirates and China. 

The cash was then transferred into cryptocurrency. Several organisations were allegedly scammed including a hospital in Missouri who lost almost $5 million, a bank in Rhode Island who lost $2.6 million and a hospital in California who lost $2.9 million. Other alleged victims included a technology company in the UK who lost $11.5 million, a financial company in Massachusetts who lost $4.6 million and a pet food company in Florida who lost $5.2 million. Hazan is alleged to have managed the money laundering. 

In court documents, Hazan claimed he had laundered $400 million since 1994. He was previously convicted of bank fraud in 2008. All three suspects are currently in custody. Soall and Hazan were arrested in Spain during the summer whilst Sheetrit was detained in the United Kingdom in September. The Justice Department said they are all facing extradition requests. 

The FBI has warned criminals are increasingly using new technology to commit complex financial frauds. James Barnacle, a senior FBI official, said the alleged fraud is an example of how sophisticated technology can be used to commit large-scale crime. The bureau has encouraged businesses who may have been targeted to report any suspected incidents.
Read more »
Hacker attack
Computer Hacking Credential stealing cryptocurrency cryptocurrency mining Cyber Security Hacker attack

Canadian Man Extradited to U.S. Over University Hacking and Cryptocurrency Mining Scheme

A Canadian national has been extradited to the United States to face charges over an alleged hacking operation that targeted universities and used compromised computers to mine cryptocurrency. The scheme, which prosecutors say ran from 2016 to 2019, allegedly involved stealing login credentials, deploying malware and exploiting the computing resources of educational institutions for financial gain. 

Ryan James Roach, 35, of Saskatchewan, and Mathiew James Stubbings, 41, of Ontario, have been indicted by a federal grand jury in the Western District of New York. Both face charges including conspiracy to obtain information from protected computers and cause damage to them, unauthorised acquisition of computer information and intentional computer damage. The charges carry potential penalties of up to 10 years in prison and a $250,000 fine. 

According to the indictment, the alleged operation took place between June 2016 and December 2019. The two defendants are accused of targeting educational institutions in New York, Tennessee, North Carolina and Massachusetts, particularly institutions with access to supercomputers. At least some of the compromised systems were located at a higher education institution in the Western District of New York. Prosecutors allege that Roach and Stubbings used virtual private servers hosted in multiple countries to distribute malware and cryptocurrency-mining software. 

The servers were reportedly registered under false identities and also used to retain credentials stolen from victims. To disguise their activity, the defendants allegedly routed their operations through servers and computers that had already been compromised at other institutions. After gaining unauthorised access, the pair allegedly installed malware, collected login credentials and transferred stolen information to infrastructure under their control. They then made victim machines perform cryptocurrency-mining operations, using their processing capacity to generate revenue for the defendants. 

The indictment further alleges that the attackers researched security weaknesses in university networks and employed specialised tools to survey compromised environments and expand their access. The operation damaged at least 10 protected computers within a one-year period and caused losses of no less than $5,000. Roach was extradited from Canada on October 28 and appeared before U.S. Magistrate Judge Mark W. Pedersen. 

He was arraigned and remained in custody pending a detention hearing scheduled for November 3, 2026. Extradition proceedings for Stubbings are continuing in Canada. The case is being prosecuted by Assistant U.S. Attorney Meghan K. McGuire. The FBI and the Justice Department’s Computer Crime and Intellectual Property Section investigated the alleged scheme. 

The Justice Department’s Office of International Affairs also assisted in securing Roach’s arrest and extradition. The indictment represents formal criminal allegations, not a finding of guilt. Both defendants are presumed innocent unless and until proven guilty in court.
Read more »
Supply Chain
Alpine Linux Cyber Security GitLab RCE Supply Chain

Hackers Target Alpine Linux GitLab Server in Attempted Critical RCE Attack


Alpine Linux has rebuilt its GitLab server and reset all user passwords after hackers attempted to exploit a critical remote code execution (RCE) vulnerability in its development infrastructure. 

The attacks targeted a maximum-severity vulnerability tracked as CVE-2026-97229, which carries a CVSS score of 10.0. Although Alpine Linux found no evidence that the attackers successfully executed malicious code or modified its software packages, the project said it could not completely rule out a breach.

Alpine Linux is a lightweight, open-source operating system widely used as the foundation for Docker container images. Its GitLab server hosts development repositories, code reviews and continuous integration (CI) jobs, including the build recipes used to produce Alpine software packages. This makes the server an important target for attackers seeking to compromise the software supply chain.

The vulnerability is caused by an integer overflow in Onigmo, the regular expression engine included in Ruby and used by GitLab's CI/CD system. If successful, this could allow the attacker to execute arbitrary code on the vulnerable server.

GitLab disclosed the vulnerability and released security fixes on October 12. However, Alpine Linux initially installed GitLab version 19.3.4 instead of the patched 19.3.5. The project later upgraded to version 19.3.6 on October 22, but the vulnerability remained because the required Ruby security patch was missing from Alpine's custom container image.

Attackers repeatedly crashed GitLab processes

According to Alpine Linux, an attacker created a new account and began submitting specially crafted CI configurations to its GitLab server on October 20-21.

The security team recorded eight worker crashes during the attacks. Four attempts reportedly progressed partway through the exploitation process before failing to complete. 

The attackers also downloaded Alpine Linux's GitLab container image, suggesting they may have been studying the server's configuration and preparing an exploit specifically designed for that environment.

The project later discovered that upgrading GitLab alone was insufficient to address the problem. The security fix required an updated version of Ruby, which was included in GitLab's official packages but was not present in Alpine's custom image.

No evidence of software tampering found

There were doubts about a possible software supply-chain attack. If attackers had successfully compromised the GitLab server, they could potentially have accessed user information, password hashes, two-factor authentication secrets, CI/CD credentials, integration tokens and private project repositories.

GitLab rebuilt from scratch

The project also advised users to change passwords reused on other websites and to pull the updated alpinelinux/gitlab:19.3.6 container image published on October 27. This image includes Ruby 3.3.13, which contains the necessary security fix.

Read more »
Subscribe to: Posts (Atom)