Infosecurity Magazine
Iranian Hacking Group Found Hosting C2 Infrastructure in the US
Stealthy malware campaign by ‘Prince of Persia’ threat group targeting organisations worldwide discovered operating on American soil
آرشیو ۹۰ روزه
همهٔ اخبار
جستوجو در عنوان، خلاصه یا نام منبع. هر خبر به صفحهٔ اصلی خودش لینک دارد.
دسته: بدافزار و آلودگی
پاک کردن فیلترها
۵۴۵ خبر
صفحهٔ ۳ از ۱۹
CSO Online
LiteLLM release pipeline hacked to distribute credential-stealing malware
Hackers hijacked the software release pipeline of LiteLLM, a popular open-source AI gateway, to distribute credential-stealing malware, marking the project’s second supply chain compromise this year despite security measures introduced after an earlier attack. The compromised version, 1.107.0, was distributed through the Python Package Index (PyPI) and official Docker images on October 21. LiteLLM said the malicious…
CSO Online
China-linked hackers used agentic AI in attack on 2,250 Microsoft 365 tenants
A China-state-aligned threat actor compromised a ConnectWise cloud backup application and used an open-source agentic AI framework to turn its stolen credentials against more than 2,250 Microsoft 365 tenants, Microsoft said. Microsoft Threat Intelligence attributed the activity to Storm-0940, which it said has used the ARTEX framework since as early as September 2026 to automate attacks on hundreds of organizations.…
WeLiveSecurity (ESET)
MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration
ESET researchers uncover MythicRatatoskr – a previously unknown Go-based backdoor hiding its C&C server inside the Yggdrasil mesh network – that paved the way for a destructive attack against a Ukrainian grain firm
The Hacker News
LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release
LiteLLM on Wednesday disclosed that threat actors compromised "multiple independent security controls" to push a malicious version of the Python package containing a credential stealer and a backdoor. On October 21, 2026, LiteLLM's release pipeline was compromised to push 1.107.0 to the Docker Hub registry and the Python Package Index (PyPI) repository. The incident took place around 4:00 a.m.
The Cyber Express
FBI, CISA Warn SafePay Ransomware Has Hit 600+ Victims
The FBI, CISA and international partners have issued a warning about SafePay ransomware, a group that has impacted at least 600 victims across multiple critical infrastructure sectors since August 2024. Published on October 20, 2026, the joint cybersecurity advisory describes SafePay as among the most active ransomware groups in 2026, with operations affecting organizations in North America, South America, Europe and…
Security Affairs
FBI and CISA Warn of SafePay Ransomware Attacks on 600 Organizations
SafePay ransomware has hit 600+ organizations since 2024, using stolen credentials, VPN access and double extortion to pressure victims into paying. CISA, the FBI, the US Secret Service, Germany’s Landeskriminalamt Rheinland-Pfalz, and two UK law enforcement agencies jointly published an advisory this week on SafePay, a ransomware group they describe as one of the most […]
CyberInsider
Tor removes hundreds of compromised relays used to hijack SSH logins
The Tor Project has blocked hundreds of compromised relays after attackers used them to redirect SSH connections through interception servers, steal passwords, and attempt to infect destination systems with the Ebury Linux backdoor. Researcher Kaba disclosed the investigation on October 20, reporting 333 exit relays involved in the operation. The discovery began on October 2, … The post Tor removes hundreds of compro…
Securelist (Kaspersky)
How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia
Kaspersky GReAT experts discovered a new UEFI bootkit, BlackX. It exploits the Baton Drop vulnerability (CVE-2022-21894) and is similar to the BlackLotus bootkit.
Graham Cluley
Smashing Security podcast #489: How a brand new crypto wallet came with a spy inside
Imagine buying a brand new hardware wallet for your cryptocurrency with the shrink-wrap still on... what could possibly be hiding inside? We break out a Geiger counter and a cat to find out. Meanwhile, malicious ads are targeting journalists with zero-click attacks. Plus, Origin’s Spencer Thompson reveals what AI agents are really getting up to on your employees’ laptops when nobody’s looking. All this and more in ep…
Wired Security
‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire
The PHP Foundation has revealed two serious vulnerabilities that could impact millions of websites. Security experts warn that failure to quickly patch the flaws could have dire consequences.
Unit 42 (Palo Alto)
“Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities
An investigation into a threat actor bypassing AI safety controls to coordinate credential theft, VoIP fraud planning, and database exfiltration. The post “Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities appeared first on Unit 42.
Rapid7 Blog
Q3 2026 Threat Update: Attackers Are Exploiting Vulnerabilities Within 3 Days
Three days is the average time between a high-severity vulnerability becoming public and its exploitation, according to the latest Quarterly Threat Landscape Report from Rapid7. And 71% of the exploitation tracked in Q3 occurred within the first seven days.For security teams already managing growing vulnerability backlogs, this creates a difficult question: How do you reduce exposure when attackers can exploit vulner…
Dark Reading
Decades-Old Windows Utility Powers Modern ClickFix Attack
The attack uses malicious Google search results related to Amazon and leverages the "finger" utility to launch a CAPTCHA that installs malware, including the Lumma stealer.
Infosecurity Magazine
Ransomware Attacks Rise as Rival Gangs Vie For Market Supremacy
Cybercriminal groups The Gentlemen and Qilin dominate ransomware attacks - and both are evolving their tactics in an attempt to outdo one another
ANY.RUN
Your New MTTR Shortcut — Introducing Related Threat Context: Cut Time-to-Triage with Actionable IOC Context
During triage, analysts may overlook valuable threat intelligence simply because they don’t know it exists. Previous investigations, related malicious activity, and industry-specific observations could provide the context needed to decide what to investigate next. Now, all that valuable context is finally within reach! With Related Threat Context, now available to ANY.RUN Enterprise clients, SOC and […] The post Your…
Infosecurity Magazine
Children’s Data Stolen After Ransomware Attack Compromises ‘Password1’ Account
The ICO has slammed security failings by the Welsh local government data unit and IT service provider following the 2024 incident
Tenable Blog
php2shell (CVE-2026-109618, CVE-2026-109619): Frequently asked questions about critical PHP remote code execution vulnerabilities
Two critical PHP vulnerabilities could lead to unauthenticated remote code execution. Patches are available for supported PHP 8.x branches, and exploitation attempts began before public disclosure.Change logUpdate October 26: CISA added CVE-2026-109618 and CVE-2026-109619 to its KEV catalog. Added details on a regression in PHP 8.4.27 and 8.5.12 and on PHP's October 23 session upload progress advisory. Added a note o…
Security Affairs
NSO Spyware Pegasus Hit a Serbian University Rector Six Days Before Snap Elections
Citizen Lab confirmed Pegasus on a Serbian rector’s iPhone 6 days before elections, raising the known civil society spyware target count to 16. The Citizen Lab published a research note confirming that the iPhone of Vladan Đokić, Rector of the University of Belgrade, was infected with NSO Group’s Pegasus spyware sometime in 2026. The infection […]
Securelist (Kaspersky)
Operation FlashHole: Lazarus breaks security, defies control
Kaspersky researchers analyze Operation FlashHole – a recent complex attack by Lazarus, involving a sophisticated malware set, watering-hole technique and abuse of CrossWeb EX financial security software.
Unit 42 (Palo Alto)
Active Exploitation of May 2026 PAN-OS CVE-2026-0257 (Updated October 20)
Ransomware operators including Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc) are exploiting PAN-OS vulnerability CVE-2026-0257. The post Active Exploitation of May 2026 PAN-OS CVE-2026-0257 (Updated October 20) appeared first on Unit 42.
The Register - Security
Palo Alto's firewall OS has been under attack from multiple ransomware groups since June
Unit 42 investigates network compromises across numerous industries
AhnLab ASEC
Ransom & Dark Web Issues Week 4, October 2026
ASEC Blog publishes Ransom & Dark Web Issues Week 4, October 2026 The Seven Deadly Sins Claims Data Leaks from Seven Organizations Worldwide HYFLOCK Ransomware Attack on a Saudi ERP Software Company Qilin Ransomware Attack on a Japanese Investment Management Company
AhnLab ASEC
Does It Stop When Someone Is Watching? The Suspicious Behavior of a New Type of Infostealer
It is already well known that illegal software and cracked programs can be exploited for malware distribution. Recently, AhnLab identified a new type of information theft malware (Infostealer) disguised as an illegal program. This malware was first detected in mid-August and, after altering its execution method, began spreading widely in September. Notably, it not only […]
The Register - Security
'Password1' and a forgotten test account land Welsh outfits in hot water
ICO reprimands Ogi Networks and Data Cymru after ransomware breach exposes info of 3,300 people, mostly children
SOCRadar
Japan Data Breaches 2026: Inside the October Surge
Japan is facing a dense wave of breach disclosures. Since late September, at least 20 major Japanese companies have reported breaches, including Times Car, Lawson, Yakiniku King, Sourcenext and Burger King Japan, and a ransomware attack on SoftBank’s IDC Frontier cloud took 495 customer organizations offline. Between September 25 and October 8 alone, at least […]
SOCRadar
INC and The Gentlemen Ransomware: Exposed AI Infrastructure
SOCRadar Threat Research Unit (STRU) has uncovered an AI-driven intrusion ecosystem run by affiliates of the INC Ransomware and The Gentlemen Ransomware...
Graham Cluley
Police arrest Qilin ransomware suspect on holiday, as links made to Synnovis hack that contributed to patient’s death
A 28-year-old Russian man has been arrested by German police, suspected of being a key member of the Qilin ransomware gang. Detectives have linked the man to the attack against blood-testing firm Synnovis, that disrupted London hospitals, and resulted in the death of a patient. Read more in my article on the Hot for Security blog.
Dark Reading
'AdFection' Turns Ad Impressions Into Zero-Click Spyware Delivery
Spyware vendors are exploiting targeted ad bidding in the digital ecosystem to identify and track individuals and organizations of interest.
US-CERT Alerts
#StopRansomware: SafePay Ransomware
Advisory at a Glance Title #StopRansomware: SafePay Ransomware Original Publication October 20, 2026 Executive Summary This advisory details recent activity by the SafePay ransomware group. SafePay actors have been highly active since August 2024, targeting businesses and critical infrastructure across North America, South America, Europe, and Australia. SafePay actors typically gain access to networks by stealing or…