News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Mon 16 Mar· 46 articles
-
Boggy Serpens Threat Assessment
Boggy Serpens, also known as MuddyWater, is an Iranian threat group tracked by Unit 42 that targets diplomatic and critical infrastructure across the Middle East and beyond, with MOIS attribution. The group has evolved from high-volume spear phishing to a…
unit42.paloaltonetworks.com -
Wing FTP Server3 articles this day · CISA first
U.S. CISA adds a flaw in Wing FTP Server to its Known Exploited Vulnerabilities catalog · CISA Adds CVE-2025-47813 to Known Exploited Vulnerabilities Catalogue
-
U.S. CISA adds a flaw in Wing FTP Server to its Known Exploited Vulnerabilities catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added Wing FTP Server flaw CVE-2025-47813 to its Known Exploited Vulnerabilities (KEV) catalog, with a CVSS score of 4.3. The vulnerability affects Wing FTP Server versions prior to 7.4.4…
-
CISA Adds CVE-2025-47813 to Known Exploited Vulnerabilities Catalogue
CISA has added CVE‑2025‑47813 to its Known Exploited Vulnerabilities (KEV) catalogue. The flaw affects Wing FTP Server, the file‑transfer product from the vendor of the same name, and is identified as the “Wing FTP Server Information Disclosure…
-
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation, in a release dated 16 March 2026. The newly listed issue is CVE-2025-47813 Wing FTP Server Information Disclosure…
-
-
Russia-linked APT uses DRILLAPP backdoor to spy on Ukrainian targets
Russia-linked threat actors have deployed the DRILLAPP backdoor against Ukrainian entities, with a campaign observed in February 2026 that uses Edge debugging to evade detection. The operation, linked to Laundry Bear (aka UAC-0190, Void Blizzard), is…
Security Affairs -
GlassWorm Malware Evolves to Hide in Dependencies
GlassWorm has evolved to hide in dependencies, with researchers noting a shift to transitive loader delivery that uses extensionPack and extensionDependencies to deliver its payload. According to Socket's research team, malicious listings can appear harmless…
Dark Reading -
Inside Olympic Cybersecurity: Lessons From Paris 2024 to Milan Cortina 2026
Inside Olympic Cybersecurity: Lessons From Paris 2024 to Milan Cortina 2026 reveals how Franz Regul, now chief information security officer for BPI France, led the Paris 2024 Olympic and Paralympic Games’ security effort for nearly five years. The piece…
Dark Reading -
GlassWorm Attack Uses Stolen GitHub Tokens to Force-Push Malware Into Python Repos
The GlassWorm malware campaign is being used to fuel an ongoing attack that leverages stolen GitHub tokens to inject malware into hundreds of Python repositories, including Django apps, ML research code, Streamlit dashboards, and PyPI packages. According to…
The Hacker News -
Iranian Cyber Threat Evolution: From MBR Wipers to Identity Weaponization
According to Unit 42, recent Iranian cyber operations extend beyond disruption and sit within a broader strategy of asymmetric retaliation, moving from MBR‑wiper style attacks to identity‑driven abuse of enterprise management tools. The piece traces an…
unit42.paloaltonetworks.com -
Standing up for the open Internet: why we appealed Italy’s "Piracy Shield" fine
Cloudflare is appealing the €14 million fine imposed by AGCOM after resisting registration for Piracy Shield, a move Cloudflare says challenges the legality of the Italian regime and its impact on the openness of the Internet. The company notes that the…
Cloudflare -
Hacked sites deliver Vidar infostealer to Windows users
A recent campaign has seen the exploitation of compromised WordPress sites to distribute the Vidar infostealer malware. Cybercriminals utilize fake CAPTCHA pages to trick users into executing malicious commands that initiate the infection chain. Vidar is…
Malwarebytes -
New Microsoft Purview innovations for Fabric to safely accelerate your AI transformation
New Microsoft Purview innovations for Fabric to safely accelerate your AI transformation outlines a unified approach to secure and govern data as organisations accelerate their AI journeys. According to Microsoft Purview, new capabilities span data security…
techcommunity.microsoft.com -
Zombie ZIP method can fool antivirus during the first scan
Zombie ZIP is a technique that changes the first part of a ZIP file’s header to claim the contents are uncompressed while they are actually compressed, allowing many antivirus products to trust the header and skip proper decompression. In tests conducted…
-
Help on the line: How a Microsoft Teams support call led to compromise
According to Microsoft Incident Response, in our eighth Cyberattack Series report the Detection and Response Team (DART) investigated an identity-first, human-operated intrusion that relied on deception and legitimate tools rather than software exploits.…
Microsoft -
Oracle EBS Hack: Only 4 Corporate Giants Still Silent on Potential Impact
SecurityWeek reports dated 16 March 2026 that four corporate giants—Broadcom, Bechtel, Estée Lauder Companies, and Abbott Laboratories—have yet to issue any public statement about potential impact from the Oracle EBS hack. The Cl0p ransomware and extortion…
SecurityWeek -
FBI launches inquiry into Steam games spreading malware
The FBI is asking gamers who installed malware-infected Steam games to come forward as part of an ongoing investigation, with the Seattle Division issuing a notice that identifies eight titles linked to the malware. According to the FBI’s Seattle Division…
Security Affairs -
Researchers Warn of Global Surge in Fake Shipment Tracking Scams
Fake shipment tracking scams are rapidly scaling worldwide, exploiting the 161 billion annual parcel volume that fuels global e-commerce, according to Group-IB. The firm’s Threat Intelligence research team detected a spike in this type of scheme exploiting…
Infosecurity -
Security Firm Executive Targeted in Sophisticated Phishing Attack
A C-level executive at Swedish exposure management and identity security firm Outpost24 was targeted in a sophisticated phishing attack, according to SecurityWeek’s coverage. The attackers employed a DKIM-signed email, trusted redirect infrastructure,…
SecurityWeek -
Former Germany’s foreign intelligence VP hit in Signal account takeover campaign
Former Germany’s foreign intelligence VP Arndt Freytag von Loringhoven was targeted in a Signal account takeover, with attackers using his compromised account to send a malicious link to contacts; he advised recipients not to open it and deleted his account.…
Security Affairs -
Malicious npm Releases Found in Popular React Native Packages - 130K+ Monthly Downloads Compromised
On 16 March 2026, StepSecurity Threat Intel was the first to detect and report malicious npm releases in two popular React Native packages—react-native-international-phone-number and react-native-country-select. The AI Package Analyst flagged the compromised…
StepSecurity -
Delete doesn’t mean gone. Here’s how File Shredder fixes that
Delete doesn’t mean gone, and Malwarebytes’ File Shredder aims to fix that by overwriting files before removing them so recovery is unlikely. The article explains that standard deletion only removes the file reference, while the data often remains on disk…
Malwarebytes -
⚡ Weekly Recap: Chrome 0-Days, Router Botnets, AWS Breach, Rogue AI Agents & More
In this week’s recap, Google has released Chrome security updates patching two actively exploited zero‑days, CVE-2026-3909 in Skia and CVE-2026-3910 in the V8 engine, with exploits already known in the wild and patches rolled out across Windows, macOS and…
-
Attackers Abuse LiveChat to Phish Credit Card, Personal Data
Attackers have found a new way to conduct phishing by abusing LiveChat, using real-time social engineering to steal a range of sensitive data, according to Cofense's Phishing Defense Center (PDC). The campaign impersonates PayPal and Amazon and engages…
Dark Reading -
Alleged Adidas & ICFES Leaks, Belgian Banking Sale, PayPal Recruitment & 7.2M Card Listing
SOCRadar’s Dark Web Team identified a string of new underground posts this week, including an alleged Adidas customer data leak tied to a third-party service provider, and a large credit card dataset advertised for sale. The team detected a post claiming…
SOCRadar -
CrackArmor Flaws Expose Linux Systems to Privilege Escalation
A set of newly identified vulnerabilities in the Linux security module AppArmor, collectively named CrackArmor, could allow attackers to gain root access, bypass protections and trigger service outages across millions of systems, according to Infosecurity…
Infosecurity -
Ransomware Under Pressure: Tactics, Techniques, and Procedures in a Shifting Threat Landscape
The Google Threat Intelligence Group's report on ransomware reveals that since 2018, ransomware has evolved significantly due to the rise of ransomware-as-a-service (RaaS). The report highlights a decline in profitability for ransomware operations,…
Google Cloud -
/proxy/ URL scans with IP addresses, (Mon, Mar 16th)
Attempts to find proxy servers remain common in honeypot logs, with attackers often using a host header or URL hostname to trigger proxy forwarding. This weekend, a slightly different pattern appeared, listing multiple /proxy paths and counts of two for most…
SANS ISC -
Security Flaw in AWS Bedrock Code Interpreter Raises Alarms
A method for exfiltrating sensitive data from AI-powered code execution environments using DNS queries has been demonstrated by security researchers, highlighting potential risks in cloud-based AI tooling. The Phantom Labs Research report published on 16…
Infosecurity -
China-Linked Hackers Hit Asian Militaries in Patient Espionage Operation
Southeast Asian military organisations have been targeted in a China-linked cyber espionage campaign that has been active for years, according to SecurityWeek. Likely ongoing since at least 2020, the operation is attributed to a state-sponsored threat actor…
SecurityWeek -
Threat Actor Targeting VPN Users in New Credential Theft Campaign
SecurityWeek reports that a threat actor tracked as Storm-2561 has been targeting VPN users in a new credential theft campaign, using SEO poisoning to distribute malicious VPN clients. Active since at least May 2025, the group began a campaign in mid-January…
SecurityWeek -
Why Security Validation Is Becoming Agentic
The article argues that security validation is moving from a collection of siloed tools to a coordinated, agentic approach that can plan, execute, and assess validation end to end. It describes how autonomous agentic AI could compress security workflows from…
The Hacker News -
ForceMemo: Python Repositories Compromised in GlassWorm Aftermath
Hundreds of GitHub accounts were accessed using credentials stolen in the VS Code GlassWorm campaign, with threat actors abusing these credentials to hack Python repositories, according to StepSecurity reports. The campaign likely began on 8 March, targeting…
SecurityWeek -
ClickFix Campaigns Spread MacSync macOS Infostealer via Fake AI Tool Installers
Three ClickFix campaigns have been observed delivering a macOS infostealer called MacSync, with the latest iteration distributed via ClickFix lures in February 2026 targeting Belgium, India, and parts of North and South America. The campaigns rely on user…
The Hacker News -
FBI Calls for Help to Track Steam Malware Campaign
According to FBI's Seattle Division, the FBI is asking gamers who unwittingly downloaded malware from the Steam platform to help with its investigation, issuing a notice in mid-March as it pursues the threat actor behind the campaign. The FBI believes the…
Infosecurity -
DeKalb County, Tennessee sheriff and jail hit by ransomware attack
DataBreaches[.]net reports that DeKalb County, Tennessee’s sheriff and jail were hit by a ransomware attack, with Dysruption Hub noting it as a third DeKalb County victim in the United States. According to Dysruption Hub, the attack on the DeKalb County…
DataBreaches -
Free real estate: GoPix, the banking Trojan living off your memory
GoPix is an advanced persistent threat described by Securelist as a memory-only banking Trojan targeting Brazilian financial institutions’ customers and cryptocurrency users. The campaign, dated 16 March 2026, relies on malvertising and Google Ads to drive…
securelist.com -
Advanced Protection Mode in Android 17 prevents apps from misusing Accessibility Services
Android 17 introduces Advanced Protection Mode (AAPM), a feature designed to block non-accessibility apps from using the Accessibility API to curb malware abuse. The change, first reported by Android Authority and included in Android 17 Beta 2, aims to…
Security Affairs -
UK: Companies House Web Glitch Exposes Corporate Details to Fraudsters
The UK’s Companies House has suspended access to its WebFiling dashboard after being notified of a serious flaw that may have exposed countless businesses to fraud. According to Dan Neidle, founder of Tax Policy Associates, the issue was brought to his…
Infosecurity -
DRILLAPP Backdoor Targets Ukraine, Abuses Microsoft Edge Debugging for Stealth Espionage
According to S2 Grupo's LAB52 threat intelligence team, Ukrainian entities have become the target of a new campaign likely linked to threat actors associated with Russia, with the campaign observed in February 2026 and overlapping with Laundry Bear (aka…
The Hacker News -
Hacking Attempt Reported at Poland’s Nuclear Research Center
Hacking attempts targeted Poland’s National Centre for Nuclear Research (NCBJ) and were described as thwarted, with no compromise of IT systems or disruption to MARIA reactor operations. In a statement, NCBJ said the attack was recent but that there was no…
SecurityWeek
