Windows · Medium

Operation Hanoi Thief targets Vietnam with a pseudo-polyglot LNK/image file that executes malicious code via ftp.exe. The attack deploys LOTUSHARVEST stealer via DLL sideloading to steal Chrome/Edge credentials.

Devolutions Server patched a Critical SQLi flaw (CVE-2025-13757) allowing authenticated users to exfiltrate or modify data via log parameters. Update to v2025.2.21 or v2025.3.9 immediately.

WithSecure exposed TangleCrypt, a new ransomware packer that uses LZ78/XOR and embedded PE resources to hide the STONESTOP EDR killer. However, coding flaws cause unexpected crashes.

Kaspersky exposed Tomiris APT using a "polyglot" strategy (Go/Rust/Python) and Telegram/Discord for covert C2. The group targets foreign ministries with implants that steal file paths and reconnaissance data.

GeoServer patched a High-severity XXE flaw (CVE-2025-58360, CVSS 8.2) in its WMS GetMap operation. The flaw allows unauthenticated remote attackers to read arbitrary files and perform SSRF. Update to v2.27.0.

Darktrace exposed TAG-150, a new MaaS operator compromising 469+ US devices in months. The group uses ClickFix to trick victims into running malicious PowerShell that deploys the CastleLoader/CastleRAT backdoor.

North Korean APTs added 197 malicious npm packages to the "Contagious Interview" campaign. The operation uses fake crypto job assignments to deploy the OtterCookie/BeaverTail hybrid to steal credentials cross-platform.

FortiGuard exposed ShadowV2, a new Mirai botnet variant that launched an IoT test attack specifically during a global AWS outage. The XOR-encoded malware targets routers and uses a hardcoded fallback C2 for resilience.

Bloody Wolf APT is targeting Central Asia using custom Java droppers to deploy the NetSupport RAT. The group uses geo-fencing and fake Ministry of Justice lures to achieve stealthy, persistent access for espionage.

Hello everyone, today we are going to work on the “Editor” machine from Hack The Box. First, we are going to perform a reconnaissance using…

How a modern form of emotional and financial manipulation has become a global public-health issue that still has no official name.

Your files are keeping a diary.

Learn to attack WPA(2) networks! Ideally you’ll want a smartphone with you for this, preferably one that supports hosting wifi hotspots so…

AI is becoming the most privileged “employee” inside the enterprise. The security model must evolve with it from the cloud layer down to…

A10 Networks: Microsoft’s AI Infrastructure Choice Trading at 6x EBITDA — The Short Squeeze Candidate Wall Street Is Ignoring

Scams are no longer a niche criminal category.
They’re a global industry — fast, adaptive, organized, and frighteningly effective.

Understanding DPI from endpoints to the cloud, and why it remains the backbone of modern cybersecurity

After my previous tests with custom PowerShell payloads, I wanted to validate my detection coverage using a standardized framework. Enter…

Social media makes communication fast and convenient, yet that same speed creates real security gaps. Attackers use fake identities, rushed…

Seja no lume da fogueira, ou numa noite de forró, o pé deve continuar no chão; São João também é época de crimes digitais.