Cybersecurity News - Page 43

In brief: Threat actors exploit multiple Cisco flaws, Sandworm launched multiple data-wiping cyberattacks against Ukraine, and more.

Еhe malicious activity was limited to unauthorized access of cloud backup files from a specific cloud environment via an API callю

PROMPTFLUX is written in VBScript and uses a hard-coded API key to query Google’s Gemini model.

The campaign’s TTPs bear strong resemblance to known Iranian cyber espionage groups, including TA455, Charming Kitten, and MuddyWater.

The trio acted as affiliates of the BlackCat ransomware gang, breaching corporate networks, stealing sensitive data, encrypting systems, and demanding ransom payments.

The sanctions are part of a broader effort to curb North Korea’s global financial network that support the regime’s weapons development.

The attackers deployed two custom tools CurlyShell and CurlCat designed for remote code execution and covert communications.

The company disclosed that the exploit specifically targeted its V2 Composable Stable Pools.

The malware deploys a complex infrastructure that combines OpenSSH for Windows with a customized Tor hidden service.

The infection chain uses a loader and a .NET-based backdoor component that leverages OpenAI as a C&C channel.