News

Mon 1 Dec 2025· 47 articles

1. 00:32

   New TangleCrypt Packer Hides EDR Killer, But Coding Flaws Cause Ransomware to Crash Unexpectedly

   The article discusses the discovery of "TangleCrypt," a new malware packer identified by WithSecure’s STINGR Group during an investigation of a Qilin ransomware attack. TangleCrypt employs advanced encryption techniques to hide its payload, known as…

   SecurityOnline
   
2. 00:27

   Russian Tomiris APT Adopts “Polyglot” Strategy, Hijacking Telegram/Discord as Covert C2 for Diplomatic Spies

   The Tomiris APT, a Russian-speaking threat actor, has evolved its tactics by adopting a 'polyglot' strategy, utilizing popular chat applications like Telegram and Discord for command-and-control (C2) operations. This shift allows them to blend malicious…

   SecurityOnline
   
3. 00:22

   High-Severity GeoServer Flaw (CVE-2025-58360) Allows Unauthenticated XXE for File Theft and SSRF

   GeoServer has announced a critical security vulnerability (CVE-2025-58360) with a CVSS score of 8.2, allowing unauthenticated attackers to exfiltrate files or crash servers. This XML External Entity (XXE) flaw affects the Web Map Service (WMS) due to…

   SecurityOnline
   
4. 00:19

   New MaaS Operator TAG-150 Uses ClickFix Lure and Custom CastleLoader to Compromise 469 US Devices

   TAG-150 is a new Malware-as-a-Service (MaaS) operator that has rapidly compromised hundreds of devices in the U.S. since its emergence in early 2025. Utilizing social engineering and a two-pronged malware approach, TAG-150 employs ClickFix to manipulate…

   SecurityOnlineGrayBravo
   
5. 00:13

   North Korea’s “Contagious Interview” Floods npm with 200 New Packages, Using Fake Crypto Jobs to Deploy OtterCookie Spyware

   The article discusses a North Korean state-sponsored cyber campaign known as "Contagious Interview," which targets blockchain and Web3 developers by embedding malware in fake coding tests. The Socket Threat Research Team reports that nearly 200 malicious npm…

   SecurityOnline
   
6. 00:05

   ShadowV2 Mirai Botnet Launched Coordinated IoT Test Attack During Global AWS Outage

   The article discusses the emergence of "ShadowV2," a new variant of the Mirai botnet that launched a coordinated attack during a significant AWS outage in October. FortiGuard Labs reported that this attack was likely a test run, exploiting vulnerabilities in…

   SecurityOnline
   
7. 00:00

   Bloody Wolf APT Expands to Central Asia, Deploys NetSupport RAT via Custom Java Droppers and Geo-Fencing

   The article discusses the expansion of the advanced persistent threat (APT) group known as Bloody Wolf into Central Asia, specifically targeting Kyrgyzstan and Uzbekistan. Active since late 2023, the group has shifted from using common malware to deploying…

   SecurityOnline