News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Thu 15 Oct | 78 | 15 |
| Fri 16 Oct | 61 | 12 |
| Sat 17 Oct | 10 | 1 |
| Sun 18 Oct | 10 | 0 |
| Mon 19 Oct | 60 | 12 |
| Tue 20 Oct | 86 | 16 |
| Wed 21 Oct | 96 | 18 |
| Thu 22 Oct | 84 | 11 |
| Fri 23 Oct | 68 | 16 |
| Sat 24 Oct | 13 | 4 |
| Sun 25 Oct | 13 | 2 |
| Mon 26 Oct | 76 | 20 |
| Tue 27 Oct | 95 | 18 |
| Wed 28 Oct | 87 | 15 |
| Today, Thu 29 Oct | 5 so far | 1 |
Developing
Tue 20 May 202591 articles
- PowerSchool hacker pleads guilty to student data extortion scheme
A 19-year-old college student from Worcester, Massachusetts, has agreed to plead guilty to a massive cyberattack on PowerSchool that extorted millions of dollars in exchange for not leaking the personal data of millions of students and teachers. [...]
BleepingComputer - KrebsOnSecurity Hit With Near-Record 6.3 Tbps DDoS
KrebsOnSecurity last week was hit by a near record distributed denial-of-service (DDoS) attack that clocked in at more than 6.3 terabits of data per second (a terabit is one trillion bits of data). The brief attack appears to have been a test run for a…
Krebs on Security - Fake Kling AI Malvertisements Lure Victims With False Promises
Researchers noted that they found several similar websites, two of which are still operating and require the same kind of behavior on behalf of the victim.
Dark Reading - Massachusetts hacker to plead guilty to PowerSchool data breach
Nate Raymond reports: A Massachusetts man has agreed to plead guilty to hacking cloud-based education software provider PowerSchool and stealing data pertaining to millions of students and teachers that hackers used to extort the company and school districts…
DataBreaches - Mobile carrier Cellcom confirms cyberattack behind extended outages
Wisconsin wireless provider Cellcom has confirmed that a cyberattack is responsible for the widespread service outage and disruptions that began on the evening of May 14, 2025. [...]
BleepingComputer - Premium WordPress 'Motors' theme vulnerable to admin takeover attacks
A critical privilege escalation vulnerability has been discovered in the premium WordPress theme Motors, which allows unauthenticated attackers to hijack administrator accounts and take complete control of websites. [...]
BleepingComputer - Adapting to new USCG cybersecurity mandates: Darktrace for ports and maritime systems
Darktrace uses AI-led OT, IoT, and IT Network Security to help secure maritime transportation systems. This blog describes some of the new mandated requirements by the USCG and demonstrates Darktrace’s security capabilities.
darktrace.com - VanHelsing ransomware builder leaked on hacking forum
The VanHelsing ransomware-as-a-service operation published the source code for its affiliate panel, data leak blog, and Windows encryptor builder after an old developer tried to sell it on the RAMP cybercrime forum. [...]
BleepingComputer - Cyberattack brings down Kettering Health phone lines, MyChart patient portal access
Samantha Wildow and Josh Sweigart report: A cyberattack is causing a system-wide technology outage at Kettering Health, forcing some medical procedures to be canceled, bringing down phone lines and the MyChart patient portal and diverting emergency crews to…
DataBreaches - Virgin Media 02 Vuln Exposes Call Recipient Location
A hacker exploiting the security flaw in the mobile provider's network could have potentially located a call recipient with accuracy of up to 100 square meters.
Dark Reading - 4G Calling (VoLTE) flaw allowed to locate any O2 customer with a phone call
A flaw in O2 4G Calling (VoLTE) leaked user location data via network responses due to improper IMS standard implementation. A flaw in 4G Calling (VoLTE) service of the UK telecom O2 exposed user location data through network responses due to flaws in the…
Security Affairs - Tenable Adds Third-Party Connectors to Exposure Management Platform
TenableOne now pulls in data from AWS, Microsoft, and competitors to provide a holistic security view of the organization's attack surface.
Dark Reading - SK Telecom says malware breach lasted 3 years, impacted 27 million numbers
SK Telecom says that a recently disclosed cybersecurity incident in April, first occurred all the way back in 2022, ultimately exposing the USIM data of 27 million subscribers. [...]
BleepingComputer - Regeneron Pledges Privacy Protection in $256M Bid for 23andMe
Regeneron's acquisition of 23andMe raises significant privacy concerns as experts warn about the lack of comprehensive federal regulations governing the transfer of genetic information.
Dark Reading - Gujarat ATS arrests 18-year-old for cyberattacks during Operation Sindoor
Maulik Pathak reports: The Gujarat Anti-Terrorism Squad (ATS) has arrested 18-year-old Jasim Shahnawaz Ansari from Nadiad who, along with other juvenile accomplices, orchestrated multiple cyberattacks against several Indian government websites, especially…
DataBreaches - Bumblebee Malware Takes Flight via Trojanized VMware Utility
An employee inadvertently downloaded a malicious version of the legitimate RVTools utility, which launched an investigation into an attempted supply chain attack aimed at delivering the recently revived initial-access loader.
Dark Reading - Hazy Hawk gang exploits DNS misconfigs to hijack trusted domains
A threat actor named 'Hazy Hawk' has been using DNS CNAME hijacking to hijack abandoned cloud endpoints of domains belonging to trusted organizations and incorporate them in large-scale scam delivery and traffic distribution systems (TDS). [...]
BleepingComputer - Hazy Hawk Exploits DNS Records to Hijack CDC, Corporate Domains for Malware Delivery
A threat actor known as Hazy Hawk has been observed hijacking abandoned cloud resources of high-profile organizations, including Amazon S3 buckets and Microsoft Azure endpoints, by leveraging misconfigurations in the Domain Name System (DNS) records. The…
The Hacker News - Large Retailers Land in Scattered Spider's Ransomware Web
The threat group games IT help desks to gain entry into retailer networks, and signs show it has shifted its attention from the UK to US targets.
Dark Reading - Hackers Nab 15 Years of UK Legal Aid Applicant Data
Akshaya Asokan reports: Hackers stole from the U.K. Ministry of Justice personal information pertaining to criminal defendants in need of an attorney, the British government disclosed Monday. The ministry on Monday said it detected on April 23 a breach that…
DataBreaches - Accenture Files Leak – New Research Reveals Projects Controlling Billions of User Data
A new research report released today by Progressive International, Expose Accenture, and the Movement Research Unit uncovers the sprawling influence of Accenture, the world’s largest consultancy firm, in driving a global wave of surveillance, exclusion, and…
gbhackers.com - Kimsuky APT Group Deploys PowerShell Payloads to Deliver XWorm RAT
Cybersecurity researchers have uncovered a sophisticated malware campaign orchestrated by the notorious Kimsuky Advanced Persistent Threat (APT) group, deploying intricately crafted PowerShell payloads to deliver the XWorm Remote Access Trojan (RAT). This…
gbhackers.com - 100+ Fake Chrome Extensions Found Hijacking Sessions, Stealing Credentials, Injecting Ads
An unknown threat actor has been attributed to creating several malicious Chrome Browser extensions since February 2024 that masquerade as seemingly benign utilities but incorporate covert functionality to exfiltrate data, receive commands, and execute…
The Hacker News - 'Hazy Hawk' Cybercrime Gang Swoops In for Cloud Resources
Since December 2023, the threat group has preyed on domains belonging to the US Centers for Disease Control and Prevention (CDC) and numerous other reputable organizations worldwide to redirect users to malicious sites.
Dark Reading - More_Eggs Malware Uses Job Application Emails to Distribute Malicious Payloads
The More_Eggs malware, operated by the financially motivated Venom Spider group (also known as Golden Chickens), continues to exploit human trust through meticulously crafted social engineering. Sold as a Malware-as-a-Service (MaaS) to notorious threat…
gbhackers.com - RVTools hit in supply chain attack to deliver Bumblebee malware
The official website for the RVTools VMware management tool was taken offline in what appears to be a supply chain attack that distributed a trojanized installer to drop the Bumblebee malware loader on users' machines. [...]
BleepingComputer - RedisRaider Campaign Targets Linux Servers by Exploiting Misconfigured Redis Instances
Datadog Security Research has uncovered a formidable new cryptojacking campaign dubbed “RedisRaider,” specifically targeting Linux servers with publicly accessible Redis instances. This sophisticated Linux worm employs aggressive propagation techniques and…
gbhackers.com - Service desks are under attack: What can you do about it?
Service desks are on the front lines of defense—and attackers know it. Attackers are using social engineering attacks to trick agents into changing passwords, disabling MFA, and granting access. Learn more from Specops Software on how to secure your service…
BleepingComputer - Why Rigid Security Programs Keep Failing
Organizations that stay ahead of attacks won't be the most compliant ones — they'll be the ones most honest about what actually works.
Dark Reading - Novel Phishing Attack Combines AES With Poisoned npm Packages
Researchers discovered a phishing attack in the wild that takes multiple well-tread technologies like open source packages and AES encryption and combines them.
Dark Reading - Hackers Abuse TikTok and Instagram APIs to Verify Stolen Account Credentials
Cybercriminals are leveraging the Python Package Index (PyPI) to distribute malicious tools designed to exploit TikTok and Instagram APIs for verifying stolen account credentials. Security researchers at Socket have identified three such packages…
gbhackers.com - NATO-Flagged Vulnerability Tops Latest VMware Security Patch Batch
VMware patches flaws that expose users to data leakage, command execution and denial-of-service attacks. No temporary workarounds available.
SecurityWeek - Regeneron to Buy 23andMe for $256M Amid Growing Data Privacy Concerns
Biotechnology giant Regeneron Pharmaceuticals has emerged as the successful bidder in the bankruptcy auction for genetic testing pioneer 23andMe, offering $256 million for the majority of the company’s assets. Announced Monday, the deal would transfer…
gbhackers.com - CISA Includes MDaemon Email Server XSS Flaw in KEV Catalog
Cybersecurity and Infrastructure Security Agency (CISA) has added a cross-site scripting (XSS) vulnerability affecting MDaemon Email Server to its Known Exploited Vulnerabilities (KEV) Catalog on May 19, 2025. This critical addition, identified as…
gbhackers.com - Hackers Use Weaponized RAR Archives to Deliver Pure Malware in Targeted Attacks
Russian organizations have become prime targets of a sophisticated malware campaign deploying the Pure malware family, first identified in mid-2022. Distributed via a Malware-as-a-Service (MaaS) model, Pure malware allows cybercriminals to purchase and…
gbhackers.com - South Asian Ministries Hit by SideWinder APT Using Old Office Flaws and Custom Malware
High-level government institutions in Sri Lanka, Bangladesh, and Pakistan have emerged as the target of a new campaign orchestrated by a threat actor known as SideWinder. "The attackers used spear phishing emails paired with geofenced payloads to ensure that…
The Hacker News - China-linked UnsolicitedBooker APT used new backdoor MarsSnake in recent attacks
China-linked UnsolicitedBooker used a new backdoor, MarsSnake, to target an international organization in Saudi Arabia. ESET researchers revealed that a China-linked APT, tracked as UnsolicitedBooker, targeted an international organization in Saudi Arabia…
Security Affairs - AWS Default IAM Roles Found to Enable Lateral Movement and Cross-Service Exploitation
Cybersecurity researchers have discovered risky default identity and access management (IAM) roles impacting Amazon Web Services that could open the door for attackers to escalate privileges, manipulate other AWS services, and, in some cases, even fully…
The Hacker News - Vulnerability Exploitation Probability Metric Proposed by NIST, CISA Researchers
The Likely Exploited Vulnerabilities (LEV) equations can help augment KEV- and EPSS-based remediation prioritization.
SecurityWeek - Cyberattack on Serviceaide Compromises Data of 480,000 Catholic Health Patients
Data breach at Serviceaide, Inc., a technology vendor for Catholic Health, exposed sensitive information belonging to approximately 480,000 patients. The incident, caused by an improperly secured Elasticsearch database, left names, Social Security numbers,…
gbhackers.com