Category: Cyber Security News

Anthropic was designated a “supply chain risk” by the Department of War after negotiations collapsed over requests to prohibit its AI model Claude from being used for mass domestic surveillance and fully autonomous weapons. The designation triggered federal orders to phase out Anthropic technology, widespread employee support from other AI firms,…

Meta will notify parents if their child repeatedly searches Instagram for language related to self-harm or suicide within a short time frame, and the system will expand beyond the U.S., U.K., Australia and Canada later this year. The company is also building alerts for teens’ AI conversations about self-harm, with notifications…

Texas Attorney General Ken Paxton said Samsung agreed to stop collecting and processing Automated Content Recognition (ACR) viewing data from Texas consumers without first obtaining consent, resolving a lawsuit the state filed in December. Samsung will update its smart TVs with clear, conspicuous disclosure and consent screens while similar lawsuits against…

President Donald Trump ordered all federal agencies to phase out Anthropic technology after a public dispute between the company and the Pentagon over military use and AI safety. The standoff — which includes threats of contract termination, supply-chain risk designation, and potential use of the Defense Production Act — has polarized…

CISA has released new technical details on RESURGE, a persistent implant that exploited the CVE-2025-0282 zero-day to compromise Ivanti Connect Secure devices. The implant remains latent until a specific inbound TLS connection using CRC32 TLS fingerprinting and a forged Ivanti certificate is received, and includes components like libdsupgrade.so, a SpawnSloth variant (liblogblock.so), and dsmain for persistence and log tampering. #RESURGE #IvantiConnectSecure

Europol’s yearlong Project Compass operation led to 30 arrests and tied 179 suspects to “The Com,” a decentralized online collective that targets children and teenagers. The investigation across 28 countries identified 62 victims, safeguarded four, exposed grooming and extortion subgroups (including “764”), and linked The Com to ransomware and intrusion attacks on Marks & Spencer, Co-op, and Harrods. #TheCom #ProjectCompass

North Korean state-backed group APT37 is running a campaign called Ruby Jumper that uses removable drives to bridge air-gapped systems for data exfiltration and covert surveillance. Researchers at Zscaler identified a five-tool toolkit — RESTLEAF, SNAKEDROPPER, THUMBSBD, VIRUSTASK, and FOOTWINE — that leverages LNK/PowerShell chains, Zoho WorkDrive C2, and a hidden Ruby runtime to persist and spread. #APT37 #RubyJumper

Microsoft’s Windows 11 Insider Preview builds introduce a secure batch processing mode that prevents batch files from being modified during execution, configurable via the LockBatchFilesInUse registry value or the LockBatchFilesWhenInUse application manifest control. The update also improves performance by reducing signature validation overhead when code integrity is enabled and enhances Shared Audio with individual volume sliders, a taskbar indicator, and expanded Bluetooth LE Audio support. #Windows11 #LockBatchFilesInUse

Alex Bovicelli explains that the current SMB ransomware wave is being fueled by Initial Access Brokers and requires a shift from reactive defenses to targeted intelligence. He highlights how Tokio Marine HCC leverages incident visibility to track infostealer logs and surface compromised credentials before they can be weaponized. #TokioMarineHCC #Infostealers

Meta on Thursday said it’s taking legal action to tackle scams on its platforms by filing lawsuits against what it calls deceptive advertisers based in Brazil, China, and Vietnam, while suspending payment methods, disabling accounts, and blocking scam domains. The company also issued cease-and-desist letters to consultants selling ad-policy bypass and…

European lawmakers approved an opinion recommending that under-16s need parental consent to use social media and that access under 13 be banned entirely. The nonbinding text urges inclusion of such a ban in the proposed Digital Fairness Act and calls for privacy-friendly age verification, limits on targeted advertising and AI safeguards…

Threat actors are distributing trojanized gaming utilities via browsers and chat platforms to deliver a multi-purpose remote access trojan that stages a portable Java runtime and runs a malicious jd-gui.jar using PowerShell and LOLBins like cmstp.exe. The attacks delete initial downloaders, configure Microsoft Defender exclusions, establish persistence via a scheduled task…

Zscaler ThreatLabz attributes a Ruby Jumper campaign to North Korea–linked ScarCruft that uses a malicious LNK file and embedded PowerShell to carve multiple payloads and deploy a multi-stage toolset including RESTLEAF, SNAKEDROPPER, THUMBSBD, VIRUSTASK, FOOTWINE, and BLUELIGHT. Notably, RESTLEAF abuses Zoho WorkDrive for C2 communications while THUMBSBD and VIRUSTASK weaponize removable…

A Greek court convicted Intellexa founder Tal Dilian and three associates for unlawful access and privacy violations connected to the Predator spyware, handing down a combined sentence of over 126 years that is limited to eight years under Greek law. The verdict, which followed documentation by groups like Citizen Lab and…