Security Affairs چهارشنبه ۲۰ آبان ۱۴۰۵ · ۰۰:۱۰

Russia-Linked APT Turla Turned Exchange Servers Into Their Own Control Room

ESET found Russia-Linked APT group Turla using a new toolset, dubbed Cereal, on government Exchange servers in Kazakhstan and Romania. ESET Research detailed a previously undocumented toolset it calls Cereal, built to run on Microsoft Exchange servers. The researchers found it on 28 November 2025 at a government body in Kazakhstan, and later at a […]

Malware & Threats Threat Intelligence

Read the full article at Security Affairs Removal request

This page shows only the headline and the short summary. The full text is published by the original source.

Related news

Full archive →

BleepingComputer سه‌شنبه ۱۹ آبان ۱۴۰۵ · ۲۳:۰۱

Hackers exploit trusted AWS access to breach multiple cloud environments

A threat actor used compromised identity and access management (IAM) credentials for a Qubole big data platform's AWS account to access and exfiltrate data from multiple customers' AWS environments. [...]

Data Breach Threat Intelligence Data Science & Analytics

Source

CyberScoop سه‌شنبه ۱۹ آبان ۱۴۰۵ · ۲۱:۱۶

Vanderbilt University reels following ransomware attack claimed by BYOD group

Some services began returning online Tuesday following a ransomware incident detected on Monday across Vanderbilt systems and applications. The post Vanderbilt University reels following ransomware attack claimed by BYOD group appeared first on CyberScoop.

Malware & Threats Ransomware

Source

The Hacker News سه‌شنبه ۱۹ آبان ۱۴۰۵ · ۲۱:۱۳

Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem

Three distinct threat activity clusters with shared infrastructure and malware code similarities have been observed targeting telecommunications providers, government organizations, military entities, research institutions, and critical infrastructure across Latin America, Asia, and Europe over the past year. Check Point Research is tracking the clusters under the names SilentDelivery,

Malware & Threats

Source

The Hacker News سه‌شنبه ۱۹ آبان ۱۴۰۵ · ۱۹:۳۰

Attackers Exploit AhsayCBS Flaws to Deploy Sandbox-Evading Python Backdoor

Cybersecurity researchers have disclosed details of an attack that exploited two now-patched vulnerabilities in AhsayCBS to deliver a Python-based implant. The activity, observed by Huntress in October 2026, involves the exploitation of a chain comprising CVE-2026-105133 and CVE-2026-105134 to bypass authentication and execute arbitrary commands on affected systems. Patches for the two

Malware & Threats Vulnerabilities & Zero-Day Programming & Languages

Source