Tag: post-exploitation
-
Cloud Blog: Oracle E-Business Suite Zero-Day Exploited in Widespread Extortion Campaign
Source URL: https://cloud.google.com/blog/topics/threat-intelligence/oracle-ebusiness-suite-zero-day-exploitation/ Source: Cloud Blog Title: Oracle E-Business Suite Zero-Day Exploited in Widespread Extortion Campaign Feedly Summary: Written by: Peter Ukhanov, Genevieve Stark, Zander Work, Ashley Pearson, Josh Murchie, Austin Larsen Introduction Beginning Sept. 29, 2025, Google Threat Intelligence Group (GTIG) and Mandiant began tracking a new, large-scale extortion campaign by a threat actor…
-
Cloud Blog: Another BRICKSTORM: Stealthy Backdoor Enabling Espionage into Tech and Legal Sectors
Source URL: https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign/ Source: Cloud Blog Title: Another BRICKSTORM: Stealthy Backdoor Enabling Espionage into Tech and Legal Sectors Feedly Summary: Written by: Sarah Yoder, John Wolfram, Ashley Pearson, Doug Bienstock, Josh Madeley, Josh Murchie, Brad Slaybaugh, Matt Lin, Geoff Carstairs, Austin Larsen Introduction Google Threat Intelligence Group (GTIG) is tracking BRICKSTORM malware activity, which is…
-
Cloud Blog: ViewState Deserialization Zero-Day Vulnerability in Sitecore Products (CVE-2025-53690)
Source URL: https://cloud.google.com/blog/topics/threat-intelligence/viewstate-deserialization-zero-day-vulnerability/ Source: Cloud Blog Title: ViewState Deserialization Zero-Day Vulnerability in Sitecore Products (CVE-2025-53690) Feedly Summary: Written by: Rommel Joven, Josh Fleischer, Joseph Sciuto, Andi Slok, Choon Kiat Ng In a recent investigation, Mandiant Threat Defense discovered an active ViewState deserialization attack affecting Sitecore deployments leveraging sample machine keys that had been exposed in…
-
The Register: Like burglars closing a door, Apache ActiveMQ attackers patch critical vuln after breaking in
Source URL: https://www.theregister.com/2025/08/19/apache_activemq_patch_malware/ Source: The Register Title: Like burglars closing a door, Apache ActiveMQ attackers patch critical vuln after breaking in Feedly Summary: Intruders hoped no one would notice their presence Criminals exploiting a critical vulnerability in open source Apache ActiveMQ middleware are fixing the flaw that allowed them access, after establishing persistence on Linux…
-
Microsoft Security Blog: Exploitation of CLFS zero-day leads to ransomware activity
Source URL: https://www.microsoft.com/en-us/security/blog/2025/04/08/exploitation-of-clfs-zero-day-leads-to-ransomware-activity/ Source: Microsoft Security Blog Title: Exploitation of CLFS zero-day leads to ransomware activity Feedly Summary: Microsoft Threat Intelligence Center (MSTIC) and Microsoft Security Response Center (MSRC) have discovered post-compromise exploitation of a newly discovered zero-day vulnerability in the Windows Common Log File System (CLFS) against a small number of targets. Microsoft released…
-
Cloud Blog: Suspected China-Nexus Threat Actor Actively Exploiting Critical Ivanti Connect Secure Vulnerability (CVE-2025-22457)
Source URL: https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-exploiting-critical-ivanti-vulnerability/ Source: Cloud Blog Title: Suspected China-Nexus Threat Actor Actively Exploiting Critical Ivanti Connect Secure Vulnerability (CVE-2025-22457) Feedly Summary: Written by: John Wolfram, Michael Edie, Jacob Thompson, Matt Lin, Josh Murchie On Thursday, April 3, 2025, Ivanti disclosed a critical security vulnerability, CVE-2025-22457, impacting Ivanti Connect Secure (“ICS”) VPN appliances version 22.7R2.5 and…
-
Hacker News: How I accepted myself into Canada’s largest AI hackathon
Source URL: https://fastcall.dev/posts/genai-genesis-firebase/ Source: Hacker News Title: How I accepted myself into Canada’s largest AI hackathon Feedly Summary: Comments AI Summary and Description: Yes Summary: The text details a personal account of discovering and exploiting a vulnerability during the GenAI Genesis 2025 hackathon application process. This incident highlights significant security concerns related to misconfigurations in…
-
Unit 42: Off the Beaten Path: Recent Unusual Malware
Source URL: https://unit42.paloaltonetworks.com/unusual-malware/ Source: Unit 42 Title: Off the Beaten Path: Recent Unusual Malware Feedly Summary: Three unusual malware samples analyzed here include an ISS backdoor developed in a rare language, a bootkit and a Windows implant of a post-exploit framework. The post Off the Beaten Path: Recent Unusual Malware appeared first on Unit 42.…
-
The Register: Sidewinder goes nuclear, charts course for maritime mayhem in tactics shift
Source URL: https://www.theregister.com/2025/03/10/sidewinder_tactics_shift/ Source: The Register Title: Sidewinder goes nuclear, charts course for maritime mayhem in tactics shift Feedly Summary: Phishing and ancient vulns still do the trick for one of the most prolific groups around Researchers say the Sidewinder offensive cyber crew is starting to target maritime and nuclear organizations.… AI Summary and Description:…
-
Cisco Talos Blog: Unmasking the new persistent attacks on Japan
Source URL: https://blog.talosintelligence.com/new-persistent-attacks-japan/ Source: Cisco Talos Blog Title: Unmasking the new persistent attacks on Japan Feedly Summary: Cisco Talos has discovered an active exploitation of CVE-2024-4577 by an attacker in order to gain access to the victim’s machines and carry out post-exploitation activities. AI Summary and Description: Yes **Summary:** The text describes a sophisticated cyberattack…