TECHZONE™

Experts Find Shared Codebase Linking Morpheus and HellCat Ransomware Payloads https://thehackernews.com/2025/01/experts-find-shared-codebase-linking.html An analysis of HellCat and Morpheus ransomware operations has revealed that affiliates associated with the respective cybercrime entities are using identical code for their ransomware payloads. The findings come from SentinelOne, which analyzed artifacts uploaded to the VirusTotal malware scanning platform by the same submitter towards the end of December 2024. "These two payload samples are

How to Eliminate Identity-Based Threats https://thehackernews.com/2025/01/eliminate-identity-based-threats.html Despite significant investments in advanced technologies and employee training programs, credential and user-based attacks remain alarmingly prevalent, accounting for 50-80% of enterprise breaches[1],[2]. While identity-based attacks continue to dominate as the leading cause of security incidents, the common approach to identity security threats is still threat reduction, implementing layers of

SonicWall Urges Immediate Patch for Critical CVE-2025-23006 Flaw Amid Likely Exploitation https://thehackernews.com/2025/01/sonicwall-urges-immediate-patch-for.html SonicWall is alerting customers of a critical security flaw impacting its Secure Mobile Access (SMA) 1000 Series appliances that it said has been likely exploited in the wild as a zero-day. The vulnerability, tracked as CVE-2025-23006, is rated 9.8 out of a maximum of 10.0 on the CVSS scoring system. "Pre-authentication deserialization of untrusted data vulnerability has been identified in the

New Research: The State of Web Exposure 2025 https://thehackernews.com/2025/01/new-research-state-of-web-exposure-2025.html Are your websites leaking sensitive data? New research reveals that 45% of third-party apps access user info without proper authorization, and 53% of risk exposures in Retail are due to the excessive use of tracking tools. Learn how to uncover and mitigate these hidden threats and risks—download the full report here. New research by web exposure management specialist Reflectiz reveals several

Security Needs to Start Saying 'No' Again https://www.darkreading.com/cyber-risk/security-needs-start-saying-no-again

QakBot-Linked BC Malware Adds Enhanced DNS Tunneling and Remote Access Features https://thehackernews.com/2025/01/qakbot-linked-bc-malware-adds-enhanced.html Cybersecurity researchers have disclosed details of a new BackConnect (BC) malware that has been developed by threat actors linked to the infamous QakBot loader. "BackConnect is a common feature or module utilized by threat actors to maintain persistence and perform tasks," Walmart's Cyber Intelligence team told The Hacker News. "The BackConnect(s) in use were 'DarkVNC' alongside the IcedID

Cisco Fixes Critical Privilege Escalation Flaw in Meeting Management (CVSS 9.9) https://thehackernews.com/2025/01/cisco-fixes-critical-privilege.html Cisco has released software updates to address a critical security flaw impacting Meeting Management that could permit a remote, authenticated attacker to gain administrator privileges on susceptible instances. The vulnerability, tracked as CVE-2025-20156, carries a CVSS score of 9.9 out 10.0. It has been described as a privilege escalation flaw in the REST API of Cisco Meeting Management. "This

TRIPLESTRENGTH Hits Cloud for Cryptojacking, On-Premises Systems for Ransomware https://thehackernews.com/2025/01/triplestrength-targets-cloud-platforms.html Google on Wednesday shed light on a financially motivated threat actor named TRIPLESTRENGTH for its opportunistic targeting of cloud environments for cryptojacking and on-premise ransomware attacks. "This actor engaged in a variety of threat activity, including cryptocurrency mining operations on hijacked cloud resources and ransomware activity," the tech giant's cloud division said in its 11th

Trump Overturns Biden Rules on AI Development, Security https://www.darkreading.com/threat-intelligence/trump-overturns-biden-rules-on-ai-development-security

Chinese Cyberspies Target South Korean VPN in Supply Chain Attack https://www.darkreading.com/threat-intelligence/chinese-cyberspies-target-south-korean-vpn-supply-chain-attack

Trump Pardons 'Silk Road' Dark Web Drug Market Creator https://www.darkreading.com/threat-intelligence/trump-pardons-silk-road-dark-web-drug-market-creator

Trump Terminates DHS Advisory Committee Memberships, Disrupting Cybersecurity Review https://thehackernews.com/2025/01/trump-terminates-dhs-advisory-committee.html The new Trump administration has terminated all memberships of advisory committees that report to the Department of Homeland Security (DHS).  "In alignment with the Department of Homeland Security's (DHS) commitment to eliminating the misuse of resources and ensuring that DHS activities prioritize our national security, I am directing the termination of all current memberships on advisory

Hackers Exploit Zero-Day in cnPilot Routers to Deploy AIRASHI DDoS Botnet https://thehackernews.com/2025/01/hackers-exploit-zero-day-in-cnpilot.html Threat actors are exploiting an unspecified zero-day vulnerability in Cambium Networks cnPilot routers to deploy a variant of the AISURU botnet called AIRASHI to carry out distributed denial-of-service (DDoS) attacks. According to QiAnXin XLab, the attacks have leveraged the security flaw since June 2024. Additional details about the shortcomings have been withheld to prevent further abuse. Some

Will 2025 See a Rise of NHI Attacks? https://www.darkreading.com/vulnerabilities-threats/will-2025-see-rise-nhi-attacks

Mandatory MFA, Biometrics Make Headway in Middle East, Africa https://www.darkreading.com/cybersecurity-operations/mfa-biometrics-make-headway-middle-east-africa

Discover Hidden Browsing Threats: Free Risk Assessment for GenAI, Identity, Web, and SaaS Risks https://thehackernews.com/2025/01/discover-hidden-browsing-threats-free.html As GenAI tools and SaaS platforms become a staple component in the employee toolkit, the risks associated with data exposure, identity vulnerabilities, and unmonitored browsing behavior have skyrocketed. Forward-thinking security teams are looking for security controls and strategies to address these risks, but they do not always know which risks to prioritize. In some cases, they might have

President Trump Pardons Silk Road Creator Ross Ulbricht After 11 Years in Prison https://thehackernews.com/2025/01/president-trump-pardons-silk-road.html U.S. President Donald Trump on Tuesday granted a "full and unconditional pardon" to Ross Ulbricht, the creator of the infamous Silk Road drug marketplace, after spending 11 years behind bars. "I just called the mother of Ross William Ulbricht to let her know that in honor of her and the Libertarian Movement, which supported me so strongly, it was my pleasure to have just signed a full and

PlushDaemon APT Targets South Korean VPN Provider in Supply Chain Attack https://thehackernews.com/2025/01/plushdaemon-apt-targets-south-korean.html A previously undocumented China-aligned advanced persistent threat (APT) group named PlushDaemon has been linked to a supply chain attack targeting a South Korean virtual private network (VPN) provider in 2023, according to new findings from ESET. "The attackers replaced the legitimate installer with one that also deployed the group's signature implant that we have named SlowStepper – a

Oracle Releases January 2025 Patch to Address 318 Flaws Across Major Products https://thehackernews.com/2025/01/oracle-releases-january-2025-patch-to.html Oracle is urging customers to apply its January 2025 Critical Patch Update (CPU) to address 318 new security vulnerabilities spanning its products and services. The most severe of the flaws is a bug in the Oracle Agile Product Lifecycle Management (PLM) Framework (CVE-2025-21556, CVSS score: 9.9) that could allow an attacker to seize control of susceptible instances. "Easily exploitable

Mirai Botnet Launches Record 5.6 Tbps DDoS Attack with 13,000+ IoT Devices https://thehackernews.com/2025/01/mirai-botnet-launches-record-56-tbps.html Web infrastructure and security company Cloudflare on Tuesday said it detected and blocked a 5.6 Terabit per second (Tbps) distributed denial-of-service (DDoS) attack, the largest ever attack to be reported to date. The UDP protocol-based attack took place on October 29, 2024, targeting one of its customers, an unnamed internet service provider (ISP) from Eastern Asia. The activity originated