Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

Role: Red team and accidental uptime engineer

Author: Juan Soberanes (CyberDucky)  Date: 2025–10–30  Severity: High (CVSS 8.1)  CVE: CVE-2025–64115  GitHub Advisory: GHSA-pm58–79jw-q79f

How Large Language Models Are Rewriting the Rules of Endpoint Detection Evasion

Welcome to this new Medium post. In it I’ll present an interesting C++ program that retrieves useful information about an Active Directory…

Responding to the npm supply chain attack

Author: Berend Watchus November 30, 2025 Blog a

Scenario: You are a cybersecurity analyst working in the Security Operations Center (SOC) of BookWorld, an expansive online bookstore…

How one Air Force sergeant’s UFO disinformation campaign in the 1980s became the operating manual for nation-state cognitive warfare in…

If you want to boost your online privacy or access Finnish content from anywhere, the easiest method is to change your IP address using a…

The final week of November 2025 will likely be recorded by future historians of technology as a definitive inflection point — a moment…

Windows · Medium

Operation Hanoi Thief targets Vietnam with a pseudo-polyglot LNK/image file that executes malicious code via ftp.exe. The attack deploys LOTUSHARVEST stealer via DLL sideloading to steal Chrome/Edge credentials.

Devolutions Server patched a Critical SQLi flaw (CVE-2025-13757) allowing authenticated users to exfiltrate or modify data via log parameters. Update to v2025.2.21 or v2025.3.9 immediately.

WithSecure exposed TangleCrypt, a new ransomware packer that uses LZ78/XOR and embedded PE resources to hide the STONESTOP EDR killer. However, coding flaws cause unexpected crashes.

Kaspersky exposed Tomiris APT using a "polyglot" strategy (Go/Rust/Python) and Telegram/Discord for covert C2. The group targets foreign ministries with implants that steal file paths and reconnaissance data.

GeoServer patched a High-severity XXE flaw (CVE-2025-58360, CVSS 8.2) in its WMS GetMap operation. The flaw allows unauthenticated remote attackers to read arbitrary files and perform SSRF. Update to v2.27.0.

Darktrace exposed TAG-150, a new MaaS operator compromising 469+ US devices in months. The group uses ClickFix to trick victims into running malicious PowerShell that deploys the CastleLoader/CastleRAT backdoor.

North Korean APTs added 197 malicious npm packages to the "Contagious Interview" campaign. The operation uses fake crypto job assignments to deploy the OtterCookie/BeaverTail hybrid to steal credentials cross-platform.

FortiGuard exposed ShadowV2, a new Mirai botnet variant that launched an IoT test attack specifically during a global AWS outage. The XOR-encoded malware targets routers and uses a hardcoded fallback C2 for resilience.