TECHZONE™

Salt Typhoon Exploits Cisco Devices in Telco Infrastructure https://www.darkreading.com/cyberattacks-data-breaches/salt-typhoon-exploits-cisco-devices-telco-infrastructure

Warning: Tunnel of Love Leads to Scams https://www.darkreading.com/cyber-risk/warning-tunnel-of-love-leads-to-scams

CyberArk Makes Identity Security Play With Zilla Acquisition https://www.darkreading.com/identity-access-management-security/cyberark-makes-identity-security-play-zilla-acquisition

AI-Powered Social Engineering: Ancillary Tools and Techniques https://thehackernews.com/2025/02/ai-powered-social-engineering-ancillary.html Social engineering is advancing fast, at the speed of generative AI. This is offering bad actors multiple new tools and techniques for researching, scoping, and exploiting organizations. In a recent communication, the FBI pointed out: ‘As technology continues to evolve, so do cybercriminals' tactics.’ This article explores some of the impacts of this GenAI-fueled acceleration. And examines what

Microsoft: Russian-Linked Hackers Using 'Device Code Phishing' to Hijack Accounts https://thehackernews.com/2025/02/microsoft-russian-linked-hackers-using.html Microsoft is calling attention to an emerging threat cluster it calls Storm-2372 that has been attributed to a new set of cyber attacks aimed at a variety of sectors since August 2024. The attacks have targeted government, non-governmental organizations (NGOs), information technology (IT) services and technology, defense, telecommunications, health, higher education, and energy/oil and gas

RansomHub Becomes 2024’s Top Ransomware Group, Hitting 600+ Organizations Globally https://thehackernews.com/2025/02/ransomhub-becomes-2024s-top-ransomware.html The threat actors behind the RansomHub ransomware-as-a-service (RaaS) scheme have been observed leveraging now-patched security flaws in Microsoft Active Directory and the Netlogon protocol to escalate privileges and gain unauthorized access to a victim network's domain controller as part of their post-compromise strategy. "RansomHub has targeted over 600 organizations globally, spanning sectors

PostgreSQL Vulnerability Exploited Alongside BeyondTrust Zero-Day in Targeted Attacks https://thehackernews.com/2025/02/postgresql-vulnerability-exploited.html Threat actors who were behind the exploitation of a zero-day vulnerability in BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) products in December 2024 likely also exploited a previously unknown SQL injection flaw in PostgreSQL, according to findings from Rapid7. The vulnerability, tracked as CVE-2025-1094 (CVSS score: 8.1), affects the PostgreSQL interactive tool psql. "An

Roundtable: Is DOGE Flouting Cybersecurity for US Data? https://www.darkreading.com/cyber-risk/doge-flouting-cybersecurity-us-data

Hackers Use CAPTCHA Trick on Webflow CDN PDFs to Bypass Security Scanners https://thehackernews.com/2025/02/hackers-use-captcha-trick-on-webflow.html A widespread phishing campaign has been observed leveraging bogus PDF documents hosted on the Webflow content delivery network (CDN) with an aim to steal credit card information and commit financial fraud. "The attacker targets victims searching for documents on search engines, resulting in access to malicious PDF that contains a CAPTCHA image embedded with a phishing link, leading them to

How Public & Private Sectors Can Better Align Cyber Defense https://www.darkreading.com/cyber-risk/how-public-private-sectors-better-align-cyber-defense

North Korean APT43 Uses PowerShell and Dropbox in Targeted South Korea Cyberattacks https://thehackernews.com/2025/02/north-korean-apt43-uses-powershell-and.html A nation-state threat actor with ties to North Korea has been linked to an ongoing campaign targeting South Korean business, government, and cryptocurrency sectors. The attack campaign, dubbed DEEP#DRIVE by Securonix, has been attributed to a hacking group known as Kimsuky, which is also tracked under the names APT43, Black Banshee, Emerald Sleet, Sparkling Pisces, Springtail, TA427, and Velvet

Fast Deployments, Secure Code: Watch this Learn to Sync Dev and Sec Teams https://thehackernews.com/2025/02/fast-deployments-secure-code-watch-this.html Ever felt like your team is stuck in a constant battle? Developers rush to add new features, while security folks worry about vulnerabilities. What if you could bring both sides together without sacrificing one for the other? We invite you to our upcoming webinar, "Opening the Fast Lane for Secure Deployments." This isn’t another tech talk full of buzzwords—it's a down-to-earth session that

Hackers Exploited PAN-OS Flaw to Deploy Chinese Malware in Ransomware Attack https://thehackernews.com/2025/02/hackers-exploited-pan-os-flaw-to-deploy.html An RA World ransomware attack in November 2024 targeting an unnamed Asian software and services company involved the use of a malicious tool exclusively used by China-based cyber espionage groups, raising the possibility that the threat actor may be moonlighting as a ransomware player in an individual capacity. "During the attack in late 2024, the attacker deployed a distinct toolset that had

AI and Security - A New Puzzle to Figure Out https://thehackernews.com/2025/02/ai-and-security-new-puzzle-to-figure-out.html AI is everywhere now, transforming how businesses operate and how users engage with apps, devices, and services. A lot of applications now have some Artificial Intelligence inside, whether supporting a chat interface, intelligently analyzing data or matching user preferences. No question AI benefits users, but it also brings new security challenges, especially Identity-related security

Palo Alto Networks Patches Authentication Bypass Exploit in PAN-OS Software https://thehackernews.com/2025/02/palo-alto-networks-patches.html Palo Alto Networks has addressed a high-severity security flaw in its PAN-OS software that could result in an authentication bypass. The vulnerability, tracked as CVE-2025-0108, carries a CVSS score of 7.8 out of 10.0. The score, however, drops to 5.1 if access to the management interface is restricted to a jump box. "An authentication bypass in the Palo Alto Networks PAN-OS software enables an

FINALDRAFT Malware Exploits Microsoft Graph API for Espionage on Windows and Linux https://thehackernews.com/2025/02/finaldraft-malware-exploits-microsoft.html Threat hunters have shed light on a new campaign targeting the foreign ministry of an unnamed South American nation with bespoke malware capable of granting remote access to infected hosts. The activity, detected in November 2024, has been attributed by Elastic Security Labs to a threat cluster it tracks as REF7707. Some of the other targets include a telecommunications entity and a university,

Japan Goes on Offense With New 'Active Cyber Defense' Bill https://www.darkreading.com/cybersecurity-operations/japan-offense-new-cyber-defense-bill

President Trump to Nominate Former RNC Official as National Cyber Director https://www.darkreading.com/cyber-risk/president-trump-nominate-former-rnc-official-national-cyber-director

Feds Sanction Russian Hosting Provider for Supporting LockBit Attacks https://www.darkreading.com/cyber-risk/feds-sanction-russian-hosting-provider-lockbit-attacks

Microsoft: Russia's Sandworm APT Exploits Edge Bugs Globally https://www.darkreading.com/threat-intelligence/microsoft-russian-sandworm-apt-exploits-edge-bugs-globally