Category: Cyber Security News

A senior FBI official said the U.S. is fully committed to leading the global fight against transnational scamming compounds in Southeast Asia after visits to Thailand, Cambodia and Vietnam exposed industrial-scale pig-butchering and cryptocurrency investment scams that rely on trafficked, indentured workers. Partnerships between the FBI, the Department of Justice and…

Timothy Youngblood rose from a self-taught programmer to serve as CISO at Dell, Kimberley‑Clark, McDonald’s and T‑Mobile before moving into angel investing and advisory roles. He now acts as a CISO in residence, guiding startups on enterprise alignment and emerging issues like non‑human identities and agentic AI. #TimothyYoungblood #KeiretsuForum…

Broadcom released patches for several vulnerabilities in VMware Aria Operations, including high-severity flaws that can lead to remote code execution, stored XSS, and privilege escalation. The most critical is CVE-2026-22719, a command injection exploitable by unauthenticated attackers, with fixes delivered in VMware Cloud Foundation and vSphere Foundation 9.0.2.0 and Aria Operations…

Arkanix Stealer was a short-lived infostealer offered as a malware-as-a-service that appeared in October 2025 and ceased operations around December 2025 after its control panel and Discord channel were taken down. It stole wide-ranging data — including system details, browser and messaging credentials, VPN client data, and cryptocurrency wallet information —…

North Korean state-backed Lazarus operators are using the Medusa RaaS to carry out extortion attacks against U.S. healthcare and non-profit organizations, with Symantec attributing the activity to a Lazarus subgroup possibly linked to Andariel/Stonefly. The campaigns use a mix of custom and commodity tools and funnel stolen funds to support espionage against defense, technology, and government targets. #Medusa #Lazarus

ShinyHunters claims responsibility for breaching Dutch telecom Odido and posting millions of stolen customer records on its dark web leak site. Odido says around 6.2 million customers were affected, denies exposure of passwords or billing data, and has reported the incident while engaging external responders. #ShinyHunters #Odido

SolarWinds released security updates for Serv-U 15.5.4 to patch four critical remote code execution vulnerabilities that could allow attackers to gain root or admin access on unpatched Windows and Linux servers. The most severe flaw, CVE-2025-40538, lets attackers with domain- or group-admin privileges create a system admin account and execute arbitrary code as root, and SolarWinds also fixed two type confusion flaws and an IDOR amid prior exploitation activity and ongoing tracking by CISA. #Serv-U #CVE-2025-40538

Symantec researchers linked North Korean state-backed Lazarus actors to financially motivated deployments of Medusa ransomware against at least two institutions, including a company in the Middle East and a U.S. healthcare organization. The report indicates a shift from in-house strains like Maui to ransomware-as-a-service offerings and attributes the intrusions using Lazarus-specific…

Spanish authorities arrested four members of the Anonymous Fénix group for carrying out distributed denial-of-service attacks against government, political, and public websites, with activity peaking after the catastrophic October 2024 floods in Valencia. Law enforcement also seized the group’s YouTube and X accounts, closed its Telegram channel, and noted related arrests…

TeamT5 confirmed that CVE-2024-7694, a vulnerability in its ThreatSonar product allowing admin users to upload malicious files and achieve arbitrary command execution, was likely exploited in targeted supply-chain attacks in 2024. The company attributes the intrusions to Chinese APTs it tracks as Slime57 and Slime62, says attackers used hundreds of compromised…

A vulnerability in GitHub Codespaces allowed attackers to inject malicious Copilot instructions via GitHub issues, enabling passive prompt injections that could leak a user’s GITHUB_TOKEN and enable repository takeover. Orca Security named the technique RoguePilot and demonstrated how hidden HTML comments, repository symlinks, and automatic JSON schema downloads could be chained…

A coalition of data protection authorities from 61 countries issued a joint warning that generative AI systems can produce realistic, non-consensual images and videos that threaten privacy, dignity, and vulnerable groups. The alert follows revelations that Grok, the AI chatbot on X, generated millions of “nudified” images and has prompted calls…

Tokyo-based test-equipment maker Advantest confirmed a ransomware attack after detecting unusual IT activity on February 15, 2026, and says it isolated affected systems and engaged third-party cybersecurity experts. The investigation is ongoing with no confirmed data or major operational impact, and the incident highlights increasing ransomware and state-backed targeting of the…

Researchers disclosed a cryptojacking campaign that uses pirated software bundles to lure victims and deploy a bespoke XMRig miner via a modular binary that functions as installer, watchdog, payload manager, and cleaner. The operation leverages BYOVD via WinRing0x64.sys (CVE-2020-14979) to escalate privileges and boost RandomX hashrates, spreads like a worm via…

A new wave of targeted cyber‑espionage dubbed “Operation Olalampo” has been attributed to the Iranian threat actor MuddyWater and is targeting organizations and individuals across the MENA region since January 26, 2026. The campaign deploys four novel malware families—CHAR, GhostBackDoor, GhostFetch, and HTTP_VIP—shows signs of AI‑assisted development, and leverages a Telegram…