CrowdCyber.com 2 months ago

GOLD SALEM Abuses Velociraptor DFIR Tool as Ransomware Precursor Following SharePoint ToolShell Exploitation

Daily CyberSecurity

GOLD SALEM Abuses Velociraptor DFIR Tool as Ransomware Precursor Following SharePoint ToolShell Exploitation

GOLD SALEM (Storm-2603) is exploiting SharePoint via ToolShell then abusing the Velociraptor DFIR tool as a ransomware precursor. The group deploys...

CrowdCyber.com 2 months ago

Unpatched Windows RasMan Flaw Allows Unprivileged Crash, Enabling Local System Privilege Escalation Exploit

Daily CyberSecurity

Unpatched Windows RasMan Flaw Allows Unprivileged Crash, Enabling Local System Privilege Escalation Exploit

0patch found an unpatched flaw in Windows RasMan that allows any user to crash the service on demand. This unprivileged crash is the necessary step...

CrowdCyber.com 2 months ago

DroidLock malware locks you out of your Android device and demands ransom

Malwarebytes

DroidLock malware locks you out of your Android device and demands ransom

Researchers have found Android malware that holds your files and your device hostage until you pay the ransom.

CrowdCyber.com 2 months ago

Kali Linux 2025.4 released with 3 new tools, desktop updates

BleepingComputer

Kali Linux 2025.4 released with 3 new tools, desktop updates

Kali Linux has released version 2025.4, its final update of the year, introducing three new hacking tools, desktop environment improvements, the pr...

CrowdCyber.com 2 months ago

New NANOREMOTE Backdoor Uses Google Drive API for Covert C2 and Links to FINALDRAFT Espionage Group

Daily CyberSecurity

New NANOREMOTE Backdoor Uses Google Drive API for Covert C2 and Links to FINALDRAFT Espionage Group

NANOREMOTE, a new Windows backdoor, leverages the Google Drive API for covert C2 and data exfiltration using OAuth 2.0 tokens. The malware shares a...

CrowdCyber.com 2 months ago

SMS Phishers Pivot to Points, Taxes, Fake Retailers

SMS Phishers Pivot to Points, Taxes, Fake Retailers – Krebs on Security

CrowdCyber.com 2 months ago

Storm-0249 Abuses EDR Process via DLL Sideloading to Cloak Ransomware Access

Daily CyberSecurity

Storm-0249 Abuses EDR Process via DLL Sideloading to Cloak Ransomware Access

Storm-0249 IAB abuses the SentinelOne EDR process via DLL sideloading to evade detection. The group uses LoLBin tools for fileless execution and se...

CrowdCyber.com 2 months ago

[updated]Another Chrome zero-day under attack: update now

Malwarebytes

[Updated] Another Chrome zero-day under attack: update now

If we’re lucky, this update will close out 2025’s run of Chrome zero-days. This one is a V8 type-confusion issue already being exploited in the...

CrowdCyber.com 2 months ago

Core Banking System Flaw: Apache Fineract IDOR Risks Authorization Bypass & Customer Data Access

Daily CyberSecurity

Core Banking System Flaw: Apache Fineract IDOR Risks Authorization Bypass & Customer Data Access

A flaw in Apache Fineract risks Authorization Bypass via IDOR (CVE-2025-58137) in its self-service API, potentially exposing customer data. Also fi...

CrowdCyber.com 2 months ago

React Patches Two New Flaws Risking Server-Crashing DoS and Source Code Disclosure

Daily CyberSecurity

React Patches Two New Flaws Risking Server-Crashing DoS and Source Code Disclosure

New flaws found in React Server Components risk a Server-Crashing DoS (CVSS 7.5) via infinite loop and Source Code Disclosure (CVE-2025-55183). Upd...

CrowdCyber.com 2 months ago

CyberVolk’s ransomware debut stumbles on cryptography weakness

BleepingComputer

CyberVolk’s ransomware debut stumbles on cryptography weakness

The pro-Russia hacktivist group CyberVolk launched a ransomware-as-a-service (RaaS) called VolkLocker that suffered from serious implementation fla...

CrowdCyber.com 2 months ago

New 01flip Ransomware Hits APAC Critical Infra: Cross-Platform Rust Weapon Uses Sliver C2

Daily CyberSecurity

New 01flip Ransomware Hits APAC Critical Infra: Cross-Platform Rust Weapon Uses Sliver C2

New 01flip ransomware (written in Rust) targets APAC critical infra across Windows/Linux. The attackers use Sliver for C2 and older exploits for ac...

CrowdCyber.com 2 months ago

CVE-2025-64188 (CVSS 9.8): Critical “Soledad” Theme Flaw Lets Subscribers Take Over WordPress Sites

Daily CyberSecurity

CVE-2025-64188 (CVSS 9.8): Critical "Soledad" Theme Flaw Lets Subscribers Take Over WordPress Sites

A Critical (CVSS 9.8) flaw in Soledad WordPress Theme allows Subscribers to escalate privileges and gain full site takeover by exploiting an expose...

CrowdCyber.com 2 months ago

DiCaprio Movie Torrent Lures Users: Agent Tesla Deployed via Malicious LNK and Subtitle File Code Hiding

Daily CyberSecurity

DiCaprio Movie Torrent Lures Users: Agent Tesla Deployed via Malicious LNK and Subtitle File Code Hiding

A movie torrent scam uses a DiCaprio film lure to infect PCs with Agent Tesla RAT. The attack chain uses LNK files and malicious code hidden in a s...

CrowdCyber.com 2 months ago

Supply Chain Attacks Targeting GitHub Actions Increased in 2025

Dark Reading

Supply Chain Attacks Targeting GitHub Actions Increased in 2025

At this week

CrowdCyber.com 2 months ago

CISA orders feds to patch actively exploited Geoserver flaw

BleepingComputer

CISA orders feds to patch actively exploited Geoserver flaw

CISA has ordered U.S. federal agencies to patch a critical GeoServer vulnerability now actively exploited in XML External Entity (XXE) injection at...

CrowdCyber.com 2 months ago

Feds: Pro-Russia Hacktivists Target US Critical Infrastructure

Dark Reading

CISA: Pro-Russia Hacktivists Target US Critical Infrastructure

So far the attacks, which compromise VNC connections in OT systems, have not been particularly destructive, but this could change as they evolve.

CrowdCyber.com 2 months ago

Apache Airflow Flaws Leak Sensitive Credentials in UI via DAG Tracebacks & Template Rendering

Daily CyberSecurity

Apache Airflow Flaws Leak Sensitive Credentials in UI via DAG Tracebacks & Template Rendering

Apache Airflow patched two flaws leaking sensitive credentials in the UI. The Moderate bug exposes secrets in DAG tracebacks (kwargs). Also fixed: ...

CrowdCyber.com 2 months ago

Apple fixes two zero-day flaws exploited in 'sophisticated' attacks

BleepingComputer

Apple fixes two zero-day flaws exploited in 'sophisticated' attacks

Apple has released emergency updates to patch two zero-day vulnerabilities that were exploited in an "extremely sophisticated attack" targeting spe...

CrowdCyber.com 2 months ago

Sophisticated Okta SSO Phishing Bypasses Defenses to Steal Session Tokens With Salary Review Lures

Daily CyberSecurity

Sophisticated Okta SSO Phishing Bypasses Defenses to Steal Session Tokens With Salary Review Lures

A sophisticated phishing campaign uses salary review lures to target M365/Okta SSO. Attackers proxy the login page to preserve customization and hi...