The Russian nation-state hacking group Sandworm was attributed by ESET to a December 29–30, 2025 attempted disruptive attack on Poland’s energy sector that used a previously undocumented wiper called DynoWiper. Polish officials, including Energy Minister Milosz Motyka and Prime Minister Donald Tusk, said the attack failed and the government is preparing…
Category: Cyber Security News
A multi-stage phishing campaign targeting Russian users delivers Amnesia RAT and a Hakuna Matata–derived ransomware via business-themed decoy documents and malicious LNK files that fetch loaders from a GitHub repository and binaries from Dropbox. The attackers abuse defendnot to disable Microsoft Defender, communicate and exfiltrate data via Telegram Bot APIs, and…
China has confirmed investigations into two senior military leaders, Zhang Youxia and Liu Zhenli, as part of Xi Jinping’s ongoing purges framed as anti-corruption within the People’s Liberation Army. The probes, described as suspicion of “serious violations of discipline and law,” are internal Communist Party disciplinary actions rather than indictments by…
Nike has launched an investigation after the WorldLeaks gang listed the company on its Tor-based leak site claiming stolen data, with a timer set to publish the files unless a ransom is paid. WorldLeaks, formed after the shutdown of Hunters International, now focuses on data theft and extortion and names nearly…
The ShinyHunters extortion group says it is conducting vishing campaigns that impersonate IT support to phish SSO credentials and MFA codes for Okta, Microsoft Entra, and Google accounts, enabling attackers to access corporate SaaS platforms. Compromised SSO dashboards let intruders pivot into services like Salesforce, Microsoft 365, Google Workspace and other connected apps to harvest data and issue extortion demands, with ShinyHunters claiming responsibility and posting breaches on its Tor leak site. #ShinyHunters #Okta #MicrosoftEntra #Google #Salesforce #Crunchbase #SoundCloud #Betterment
The U.S. CISA added five enterprise software vulnerabilities to its Known Exploited Vulnerabilities Catalog within an 18‑hour span, including flaws in Versa Concerto, Zimbra Collaboration, VMware vCenter, Vite, and the Prettier eslint-config-prettier package. The issues range from high‑severity remote code execution and heap‑overflow in VMware vCenter (CVE-2024-37079) and authentication bypass in…
AI-assisted coding can speed development but may introduce subtle security flaws when developers over-trust generated code. Intruder’s honeypot case showed an AI-added reliance on client-supplied IP headers that allowed payload injection and could have led to LFD or SSRF if used differently. #Intruder #Gemini
A coordinated campaign is exploiting CVE-2026-24061, a critical authentication-bypass flaw in GNU InetUtils’ telnetd that allows attackers to gain root by injecting a crafted USER environment variable. Although observed exploitation is limited so far, affected systems should upgrade to GNU InetUtils 2.8 or disable telnetd/block TCP port 23 to prevent compromise. #CVE-2026-24061 #GNUInetUtils
Two Venezuelan nationals, Luz Granados and Johan Gonzalez-Jimenez, were convicted for an ATM jackpotting scheme that used Ploutus malware to force older ATMs to dispense all available cash. They were sentenced or ordered to pay restitution, will be deported after their sentences, and their case connects to a broader indictment tied to alleged Tren de Aragua members. #Ploutus #TrenDeAragua
U.S. CISA warned that four vulnerabilities in Versa, Zimbra, Vite, and the eslint-config-prettier/Prettier toolchain are being actively exploited and have been added to the agency’s KEV catalog. Agencies must apply fixes or mitigations — or stop using affected products — by February 12, 2026, while details about exploitation activity and any ransomware use remain unknown. #VersaConcerto #eslint-config-prettier
Two malicious Visual Studio Code extensions on the VSCode Marketplace — ChatGPT – 中文版 and ChatMoss (CodeMoss) — collectively installed about 1.5 million times, secretly exfiltrate developer files and data to China-based servers as part of a campaign dubbed MaliciousCorgi. They pose as AI coding assistants but quietly upload opened files (encoded in Base64), can harvest up to 50 workspace files on command, and use hidden analytics SDKs (Zhuge.io, GrowingIO, TalkingData, Baidu Analytics) to fingerprint and profile users without consent. #MaliciousCorgi #VSCodeMarketplace
TikTok announced the formation of TikTok USDS Joint Venture LLC to transfer majority ownership to U.S. investors while ByteDance retains a 19.9% stake to comply with the September 2025 Executive Order. The venture will secure U.S. user data and the recommendation algorithm on Oracle’s U.S. cloud, implement NIST, ISO 27001 and…
Fortinet has confirmed it is working to fully patch a FortiCloud SSO authentication bypass after reports of exploitation on fully patched firewalls. The activity circumvents fixes for CVE-2025-59718 and CVE-2025-59719, creates persistent generic accounts, grants VPN access, and exfiltrates firewall configurations, prompting recommendations to restrict internet-facing admin access and disable FortiCloud…
CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog after evidence of active exploitation, affecting Synacor Zimbra, Versa Concerto SD-WAN, Vite, and eslint-config-prettier. The eslint-config-prettier incident was a supply-chain attack that delivered a malicious DLL called Scavenger Loader, CrowdSec reports exploitation of the Zimbra flaw since January 14, 2026, and…
Germany’s Dresden State Art Collections (SKD) suffered a targeted cyberattack that disrupted large parts of its digital and phone services, halting online ticketing, visitor services and cashless payments while museums remain open. Officials say security systems protecting the collections were not affected, restoration timelines are unclear, and the attacker, motive and…