Responding to the npm supply chain attack

Author: Berend Watchus November 30, 2025 Blog a

Scenario: You are a cybersecurity analyst working in the Security Operations Center (SOC) of BookWorld, an expansive online bookstore…

How one Air Force sergeant’s UFO disinformation campaign in the 1980s became the operating manual for nation-state cognitive warfare in…

If you want to boost your online privacy or access Finnish content from anywhere, the easiest method is to change your IP address using a…

The final week of November 2025 will likely be recorded by future historians of technology as a definitive inflection point — a moment…

Windows · Medium

Operation Hanoi Thief targets Vietnam with a pseudo-polyglot LNK/image file that executes malicious code via ftp.exe. The attack deploys LOTUSHARVEST stealer via DLL sideloading to steal Chrome/Edge credentials.

Devolutions Server patched a Critical SQLi flaw (CVE-2025-13757) allowing authenticated users to exfiltrate or modify data via log parameters. Update to v2025.2.21 or v2025.3.9 immediately.

WithSecure exposed TangleCrypt, a new ransomware packer that uses LZ78/XOR and embedded PE resources to hide the STONESTOP EDR killer. However, coding flaws cause unexpected crashes.

Kaspersky exposed Tomiris APT using a "polyglot" strategy (Go/Rust/Python) and Telegram/Discord for covert C2. The group targets foreign ministries with implants that steal file paths and reconnaissance data.

GeoServer patched a High-severity XXE flaw (CVE-2025-58360, CVSS 8.2) in its WMS GetMap operation. The flaw allows unauthenticated remote attackers to read arbitrary files and perform SSRF. Update to v2.27.0.

Darktrace exposed TAG-150, a new MaaS operator compromising 469+ US devices in months. The group uses ClickFix to trick victims into running malicious PowerShell that deploys the CastleLoader/CastleRAT backdoor.

North Korean APTs added 197 malicious npm packages to the "Contagious Interview" campaign. The operation uses fake crypto job assignments to deploy the OtterCookie/BeaverTail hybrid to steal credentials cross-platform.

FortiGuard exposed ShadowV2, a new Mirai botnet variant that launched an IoT test attack specifically during a global AWS outage. The XOR-encoded malware targets routers and uses a hardcoded fallback C2 for resilience.

Bloody Wolf APT is targeting Central Asia using custom Java droppers to deploy the NetSupport RAT. The group uses geo-fencing and fake Ministry of Justice lures to achieve stealthy, persistent access for espionage.

Hello everyone, today we are going to work on the “Editor” machine from Hack The Box. First, we are going to perform a reconnaissance using…

How a modern form of emotional and financial manipulation has become a global public-health issue that still has no official name.

Your files are keeping a diary.

Learn to attack WPA(2) networks! Ideally you’ll want a smartphone with you for this, preferably one that supports hosting wifi hotspots so…