News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Fri 6 Mar· 40 articles
-
Iran-linked MuddyWater Unveils Dindoor Backdoor via Deno
Broadcom’s Symantec Threat Hunter Team uncovered a campaign by the Iran-linked MuddyWater (aka SeedWorm, TEMP[.]Zagros, Mango Sandstorm, TA450, and Static Kitten) targeting several U.S. organisations, with activity beginning in February 2026 and continuing…
Security Affairs -
CISA orders patch after Coruna kit exploits three iOS CVEs
On 6 March 2026, the Cybersecurity and Infrastructure Security Agency ordered federal agencies to patch three critical iOS vulnerabilities that were exploited over a 10-month span in campaigns run by three distinct groups. According to Google, which…
-
Phishing exploits Windows enrolment URI to seize control via MDM
A phishing page masquerading as a Google Meet update notice can quietly hand a Windows PC to an attacker-controlled device management server after a single click. According to Malwarebytes, neither a password nor files are stolen, and there are no obvious…
Malwarebytes -
Cylake raises $45M from Greylock to bring AI security on premises
Cylake’s platform is designed to analyse security data locally and identify potential attacks without relying on public cloud infrastructure, delivering AI-native security entirely within the customer’s sovereign environment. The hardware-based cybersecurity…
Dark Reading -
North Korea linked groups weaponize AI to scale IT worker fraud
North Korean threat actors are increasingly using AI to enhance their long-running IT worker scams, with two DPRK-linked clusters, “Jasper Sleet” and “Coral Sleet,” described as applying AI to improve scale and precision of fraudulent campaigns. According to…
Dark Reading -
AI Enabled Attacks Rise as North Korean Actors Use LMs to Phish
Threat actors are increasingly operationalising AI across the cyberattack lifecycle to speed up tradecraft, using both standard model capabilities and jailbreaking techniques to bypass safeguards and carry out malicious activity, according to Microsoft…
Microsoft -
ArmorCode raises $16M to expand AI exposure management
According to SecurityWeek, Unified exposure management firm ArmorCode has raised $16 million in a strategic funding round, bringing its total raised to $81 million since its 2020 founding in Palo Alto, California. The new investment round was led by Cheyenne…
SecurityWeek -
Security Roundup: FBI breach probe and Avira privilege flaws
SecurityWeek’s roundup notes that the FBI is examining suspicious activity suggesting a breach of its computer systems, reported by CNN, while Avira has disclosed three vulnerabilities in Avira Internet Security that permit local privilege escalation and…
SecurityWeek -
MuddyWater hits firms with Dindoor backdoor; Fakeset linked
The Infosecurity Magazine report, dated 6 March 2026, says Iranian hacking group MuddyWater is targeting US firms with a new backdoor named Dindoor, detected in a campaign that began in early February and has continued after recent US and Israeli strikes on…
Infosecurity -
Cisco warns SDWAN flaws CVE-2026-20128 CVE-2026-20122
Cisco warns that two recently patched Catalyst SD-WAN flaws, CVE-2026-20128 and CVE-2026-20122, are already being actively exploited in the wild. According to CISCO, multiple vulnerabilities in Cisco Catalyst SD-WAN Manager could allow an attacker to access…
-
Transparent Tribe builds AI driven mass implants to hit India
The Pakistan-aligned threat actor known as Transparent Tribe has adopted AI-powered coding tools to mass-produce malware implants, aiming to flood target environments with disposable, polyglot binaries. According to Bitdefender, the activity focuses on…
The Hacker News -
EU Euro 7 boosts vehicle cybersecurity with data integrity rules
Manufacturers face new EU requirements under Euro 7 that place cybersecurity alongside emissions rules for new vehicles. The measures push for secure transmission of emissions and battery data, security certificates on risk assessment, threat mitigation, and…
Dark Reading -
VOID#GEIST uses APC injection to run XWorm and RAT payloads
A multi-stage malware campaign codenamed VOID#GEIST, disclosed by researchers as involving XWorm, AsyncRAT and Xeno RAT, uses batch scripts as the initial delivery path to drop encrypted payloads. The attack chain begins with a batch script fetched from a…
The Hacker News -
Hikvision Multiple Products3 articles this day · The Hacker News first
Iran weaponises cameras with CVEs to plan missile strikes · KEV adds CVE-2017-7921 and CVE-2021-22681 patch due by 26 Mar
-
Iran weaponises cameras with CVEs to plan missile strikes
Iran’s cyber-kinetic strategy is now being presented as a single doctrine, with cyber operations fused to physical warfare after the United States and Israel’s attacks began on 28 February. Following this, Check Point Research on 4 March identified…
-
KEV adds CVE-2017-7921 and CVE-2021-22681 patch due by 26 Mar
Two long-standing vulnerabilities affecting Hikvision cameras and Rockwell Automation Logix environments have been flagged by CISA as urgently requiring patching and mitigations, entering the KEV catalog as actively exploited items. The Hikvision issue,…
-
CISA flags CVE-2017-7921 CVE-2021-22681 amid Hikvision exploits
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two security flaws affecting Hikvision and Rockwell Automation products to its Known Exploited Vulnerabilities (KEV) catalog, according to CISA, citing evidence of active exploitation.…
-
-
Mandiant urges MFA and egress controls curb data wipe attacks
The article focuses on proactive measures and strategies organizations can adopt to protect against destructive cyberattacks, especially given the increasing threat landscapes in 2026. Key points include: 1. **Understanding Threats**: Destructive malware can…
Google Cloud -
Cloudflare One Protects Data Across Endpoints and AI Copilot
Cloudflare One’s unified data security vision now covers data in transit, at rest, in use, and at the prompt, aiming to ensure policy follows data rather than tool boundaries.
Cloudflare -
Hacktivists tap Claude and ChatGPT to breach nine Mexican agencies
A cyberattack on Mexico’s government agencies used AI to great effect, with a small hacktivist group reportedly compromising at least nine ministries and authorities, including the tax authority, and stealing data on citizens. Gambit Security, in a blog post…
Dark Reading -
CISA Adds Coruna iOS Exploit Kit Flaws to the KEV List, 12 CVEs
CISA has added five flaws to the Known Exploited Vulnerabilities (KEV) list, including three bugs tied to the Coruna iOS exploit kit. Coruna targets 23 vulnerabilities across iOS versions from 13.0 to 17.2.1, and has been used by multiple threat actors,…
-
ClickFix campaign uses Windows Terminal to deliver Lumma Stealer
Microsoft has flagged a new ClickFix campaign that uses Windows Terminal to deploy Lumma Stealer, with attackers guiding users to launch Terminal via Windows + X → I rather than the Run dialog. According to Microsoft Defender Experts, the social-engineering…
Security Affairs -
Rockwell PLC CVE-2021-22681 exploited in the wild, risk to plants
A Rockwell Automation vulnerability in the Studio 5000 Logix Designer software and several Logix PLCs has been exploited in attacks, according to the vendor and according to CISA. The flaw, tracked as CVE-2021-22681, was disclosed in February 2021 and…
-
Google: 90 active zero-days in 2025 targeting enterprise
According to Google Threat Intelligence Group, the number of zero-day vulnerabilities uncovered in enterprise software and appliances reached an all-time high last year, with GTIG tracking 90 zero-day vulnerabilities actively deployed in 2025. The findings…
Infosecurity -
DoD names Bishop as DCIO(CS) CISO to bolster cyber leadership
James ‘Aaron’ Bishop has been named the Department of Defense’s DCIO(CS)-CISO, taking on the role of deputy chief information officer for cybersecurity and chief information security officer, according to the Office of the Department of War (DoW) Chief…
SecurityWeek -
APT41 China linked group blends espionage with crime via phishing
Dark Web Profile: APT41 describes the operation as a China-linked intrusion set that blends state-sponsored espionage with financially motivated cybercrime, a dual-track observed since reporting began noting parallel espionage and monetisation activities.…
SOCRadar -
MuddyWater uses Dindoor and Fakeset backdoors in US networks
The Iranian APT MuddyWater has hacked into the networks of several US organisations, including an aerospace and defence contractor, Broadcom’s Symantec and Carbon Black threat hunting team reports, with activity observed since February. The threat actor has…
SecurityWeek -
Fake OpenClaw installers on GitHub deliver Vidar and GhostSocks
Attackers are seeding fake OpenClaw installers on GitHub, boosted by Bing AI search results, to deliver Vidar infostealer and GhostSocks rather than the desired AI assistant. According to researchers at Huntress, malicious GitHub repositories posed as…
Malwarebytes -
China linked actor hits Asia with DLL side loading and web shells
Unit 42 describes CL-UNK-1068 as a cluster of undetected activity dating back to at least 2020, targeting high-value organisations across South, Southeast and East Asia with a focus on sectors including aviation, energy, government, law enforcement,…
unit42.paloaltonetworks.com -
AI Driven Risk Management Lets MSPs Scale Cybersecurity Services
The Hacker News’ piece on The MSP Growth Guide explains how MSPs and MSSPs can scale cybersecurity by adopting a risk-first approach powered by AI-powered risk management. It argues that risk-based cybersecurity builds client trust, boosts upsell…
The Hacker News -
Cisco Catalyst SD-WAN Manager (CVE-2026-20122 & CVE-2026-20128) Flaws Exploited
According to Cisco PSIRT, Cisco Catalyst SD-WAN Manager (vManage) is currently being actively exploited for two vulnerabilities, CVE-2026-20122 and CVE-2026-20128. CVE-2026-20122 is an arbitrary file overwrite flaw in the vManage API that requires…
-
MuddyWater hits US banks with Dindoor backdoor via Deno runtime
According to Broadcom's Symantec and Carbon Black Threat Hunter Team, new evidence shows an Iranian hacking group embedding itself in several U.S. organisations’ networks, including banks, airports, a non-profit, and a software company with an Israel…
The Hacker News -
Q4 2025 Exploits Hit Windows and Linux, Spotlight CVE-2025-55182
The Securelist piece on Exploits and vulnerabilities in Q4 2025 notes that the fourth quarter was one of the most intense periods for high-profile vulnerability disclosures, with many flaws exploited in the wild soon after disclosure. It highlights exploits…
-
Iran-nexus APT Dust Specter targets Iraq officials with new malware
A campaign attributed to the Iran-linked Dust Specter group is targeting Iraqi government officials with phishing emails that impersonate Iraq’s Ministry of Foreign Affairs and deliver new malware families. Researchers from Zscaler ThreatLabz linked the…
Security Affairs -
Evervault raises $25M Series B to encrypt data by default
Evervault, a developer-focused data security company, has announced a $25 million Series B round to expand its infrastructure and team, bringing its total funding to $46 million. The funding was led by Ribbit Capital, with participation from Index Ventures,…
SecurityWeek -
Fake CleanMyMac Site Pushes SHub Stealer via Terminal on macOS
Malwarebytes reports a convincing fake CleanMyMac site that installs SHub Stealer on macOS by instructing victims to paste a command into Terminal, after which a shell script is downloaded and executed. The malware targets credential data and cryptocurrency…
Malwarebytes -
CISA Adds CVEs to KEV for Apple Rockwell and Hikvision Flaws
U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Apple, Rockwell, and Hikvision flaws to its Known Exploited Vulnerabilities (KEV) catalog, the agency confirming the updates on 5 March 2026. The new entries include CVE-2023-43000 (CVSS 8.8)…
-
China linked APT targets South American telcos with implants
A China-linked advanced persistent threat (APT) actor has been targeting critical telecommunications infrastructure in South America since 2024, using three undocumented implants to compromise Windows, Linux and edge devices. The activity is being tracked by…
The Hacker News -
Zero day exploits surge in 2025 hitting enterprise systems
Google’s Threat Intelligence Group (GTIG) identified 90 zero-day vulnerabilities exploited in the wild in 2025, up from 78 in 2024 and trailing the roughly 100 seen in 2023. Nearly half of the flaws targeted enterprise technologies, with 43 (48%) focused on…
Security Affairs -
ClickFix campaign uses Windows Terminal to deploy Lumma Stealer
The article details Microsoft's discovery of the ClickFix campaign, which utilizes the Windows Terminal to deploy the Lumma Stealer malware. This malware is noted for exploiting system vulnerabilities to manipulate and extract sensitive information. Key…
The Hacker News -
Green Threat Level Precedes Orlando Web Apps and APIs Training
According to ISC Stormcast For Friday, March 6th, 2026, the threat level remains green as the Internet Storm Center provides its latest briefing. The diary entry highlights upcoming training opportunities, including a class titled Application Security:…
SANS ISC
