nokia

Android car head units infected with proxy botnet malware through built-in software updaters

Android car head units infected with proxy botnet malware through built-in software updaters A newly discovered Android malware, distributed through the built-in updaters in affected Android-based car head units, turns infected devices into ad-fraud tools and nodes in a proxy botnet, Kaspersky has found. According to the researchers, it’s the first documented case of malware found on a car head unit with an infection chain specific to that type of device. “It’s worth noting that head units often include SIM card slots and can connect to the internet, enabling features like navigation and software updates. Since a head unit typically holds nothing of value to an attacker, one of the more likely attack scenarios using ‘classic’ Android malware is infecting the device to recruit it into a botnet – similar to attacks on IoT devices,” researchers explained. Kaspersky attributes the operation, with high confidence, to the MoYu Group, an actor linked to the BADBOX botnet. BADBOX is a global network of consumer products sold through the ordinary hardware supply chain, with a firmware backdoor already installed. HUMAN Security’s researchers first identified it in 2023. The affected devices run firmware from DoFun, a Chinese company that supplies infotainment software for aftermarket car head units. The entry point was TWCore, a legitimate system app whose job is to collect analytics and push software updates to the head unit. TWCore takes its instructions from a message broker hosted on a domain called cardoor[.]cn, which tells it which app files to download and install. “Notably, the object describing this message includes an installNotExists field, a Boolean flag that can be set to true or false. This flag allows TWCore to install apps that weren’t originally present on the device,” they noted. Three stages, one botnet The infection runs in layers. Stage one is a small, bare dropper called JarService. It has no other purpose than to unpack and hand off to the next stage. Head unit infection scheme (Source: Kaspersky) Stage two is a loader. It sends basic information about the infected device to a remote server, then receives a download link for the next payload. That link includes a version number, and the researchers tried other numbers to see what would come back. They found seven distinct variants of the payload, which suggests the operation has been running and updating over some time. Stage three checks in with a remote server every 90 minutes, sending along the device’s screen resolution, model, connected Wi-Fi network name and MAC address, then waits for commands from the attackers’ server. Kaspersky counted nine different commands built into the malware: return — pulls a stored value back from the device copy — sets the contents of the clipboard, optionally pulling in extra data from a link http — sends a request to a server and can save the response web — opens a link in a hidden browser view and runs JavaScript inside it loadlib — not finished at the time of the report loadlib2 — downloads and runs more code loadlib3 — not finished at the time of the report deeplink — opens a link in the phone’s browser traceroute — checks whether a target address is reachable Only loadlib2 and http were seen in use, with loadlib2 pulling down zhima, the reverse proxy module. Researchers at Nokia’s Deepfield team found the same module independently, around the same time, on TV set-top boxes rather than cars. “This confirms that the attackers’ ultimate goal is building a proxy botnet.” After Kaspersky disclosed the flaw responsibly, DoFun says it has closed the gap. “The case examined here demonstrates an even more sophisticated delivery method: distribution through the legitimate update functionality of a system application. Attackers are also actively expanding into new platforms. This malware is the first known malicious app targeting head units, which means these platforms now require protection against malware as well,“ Kaspersky concluded.

helpnetsecurity.comAug 24, 2026extracted

Android Car Malware Spreads Through Built-In Updaters for Ad Fraud, Proxy Botnet

Cybersecurity researchers have flagged a new malware family that's specifically designed to infect Android-based vehicle head unit firmware developed by DoFun. Kaspersky, which discovered the threat in June 2026, said the end goal of the malware is to serve a multi-stage downloader to enable ad fraud and creation of a proxy botnet. "The malware spread through the built-in updaters of Android-based automotive head unit firmware," security researcher Dmitry Kalinin said. "This is the first documented case of malware found on a car head unit with an infection chain specific to that type of device." The activity has been attributed with high confidence to the MoYu Group, which was outed by the HUMAN Satori Threat Intelligence and Research team last year as part of a broader ad fraud and residential proxy scheme dubbed BADBOX. In July 2025, Google filed a lawsuit against 25 unnamed individuals or entities in China for allegedly operating the BADBOX botnet and its infrastructure. A car head unit is a central hub that combines multimedia functions with partial control over certain vehicle functions. It can be factory-installed or fitted on older vehicles as part of an aftermarket upgrade. Because Android-powered card head units have become popular across both aftermarket retrofits and factory-built vehicles, a huge chunk of the standard apps, and by extension, malware, can also run on them. This, in turn, makes them an emerging target for bad actors, as they feature a SIM card slot that enables internet access for navigation and software updates. "The delivery methods for such malware are becoming highly varied – ranging from pre-installed backdoors to compromised IPTV applications," Kalinin said in a statement shared with The Hacker News. "In this researched case, we observed an even more sophisticated delivery method exploiting the legitimate software update functionality of a system app." Specifically, this involves distributing the malware via the update mechanisms built into the firmware of multiple models of Android-based head units powered by DoFun. Following responsible disclosure, the issue driving the software distribution abuse has been addressed. The starting point is a legitimate system app called TWCore ("com.tw.core"), which is designed to collect analytics and update the head unit's software in the form of APK files by making use of a MQTT message broker hosted on the "cardoor[.]cn" subdomain. The APK file is downloaded to the " /push/apk/" path for installation. The threat actors behind the campaign are said to have weaponized this update channel to deliver previously unknown malware directly to the head units using a dropper dubbed JarService, while taking steps to evade detection. The dropper is responsible for launching a loader that performs the following actions - Sends implant information to one of the attackers servers via an HTTP POST request Server responds with a link for downloading the next-stage payload ("144.217.243[.]201/vr34der34/dex3.68.png") The payload name includes a reference to a version number ("dex3.68"), allowing Kaspersky to retrieve seven distinct variants dating back to "3.57" simply by trying other version numbers. The attack chain ends with the deployment of the malware as a regular user application. However, it lacks a user interface and covertly operates in the background. It's configured to send a POST request to the command-and-control (C2) endpoint ("/cpc/api/task") every 90 minutes by default, along with information about the infected device and its configuration version. "If the configuration is outdated, the C2 server returns an updated configuration containing new C2 addresses and new paths for sending HTTP requests," Kaspersky said. "If the configuration version doesn't need updating, the C2 server instead returns integer command identifiers, which the attackers refer to as productId." "The Trojan maps each identifier to command information, which it stores as a serialized JSON object using the SharedPreferences API." The malware supports nine commands capable of displaying unwanted advertisements, executing ad fraud, and downloading additional malicious modules. It also allows attackers to receive extensive device information, including display resolution, device model, connected Wi-Fi network identifier, and MAC address. The list of commands is below - return, to return a value from SharedPreferences copy, to set clipboard contents http, to make a POST/GET HTTP request to a specified resource web, to open a link in WebView and execute arbitrary JavaScript code within it loadlib (not fully implemented) loadlib2, to download and execute arbitrary code from an URL loadlib3 (not fully implemented) deeplink, to open a URL in the browser traceroute, to check resource availability via an ICMP ping The threat actors have been found to leverage "loadlib2" and "http" commands to download "zhima," a reverse proxy module documented by Nokia Deepfield Emergency Response Team last month and selectively delivered via IPTV apps installed in cheap Android TV boxes. "Despite the efforts of cybersecurity experts and law enforcement agencies to shut down the BADBOX botnet, individual actors associated with it continue their malicious activities, infecting devices worldwide," Kalinin said. "This malware has become the very first malicious application specifically targeting car head units through an infection chain explicitly tailored for these vehicle systems. This serves as a warning that modern automotive platforms urgently require robust protection against malware."

thehackernews.comAug 21, 2026extracted

The invisible passenger in your car

securelist.comAug 21, 2026extracted

Dysphoria IoT Botnet Adds Blockchain C2 and Victim Relays After JackSkid Disruption

Dysphoria, an Internet of Things (IoT) botnet line tracked by CNCERT and XLab, has adopted blockchain-based name services and infected-device relays after a March law-enforcement operation against JackSkid infrastructure. The researchers say the design makes the botnet harder to disrupt. CNCERT, China's national computer emergency response team, and XLab, the threat-intelligence lab of Chinese firm Qi'anxin, put its population above 200,000 bots. Their telemetry logged 4,401 confirmed active devices inside China between July 14 and 20 and a single-day peak of 239,000 bots abroad. None of the counts has been independently reproduced. The researchers published no counting or de-duplication methodology, so the numbers should not be read as a precise device census. Defenders should patch exposed IoT gear, replace devices that can no longer be updated, eliminate default and weak credentials, and disable remote management and UPnP where they are not needed. The lineage runs through JackSkid, one of four IoT botnets targeted in coordinated U.S., German, and Canadian law-enforcement actions on March 19. Court documents attributed more than 90,000 DDoS commands to JackSkid alone. Within days, Nokia Deepfield and Comcast's threat lab documented the operator falling back to an Ethereum Name Service (ENS) domain, m3rnbvs5d[.]eth, for command-and-control (C2). XLab's Dysphoria timeline opens with a JackSkid sample captured on March 25, six days after the disruption, that resolves C2 through the same domain. XLab found that the burrberry[.]eth record encodes distribution-node IPv4 addresses, while 24carnforth2merseyside[.]sol supplies other infrastructure records. The DDoS sample asks a distribution node over HTTP for a current server list, and the listed endpoints are infected machines relaying traffic to the real controllers. The design keeps those controllers one step removed from the addresses exposed to bots. The XLab analysis, published July 25, tracks a fast run of builds: custom RC4 string encryption and ENS resolution at the end of April, followed by Solana Name Service (SNS) resolution in early May. A relay-only variant appeared on June 25, with UPnP-based port mapping added days later to traverse NAT gateways. The relay-only build drops the DDoS modules and instead uses UPnP to map ports on the local gateway and Linux epoll to shuttle traffic between an outside connection and a remote C2 service. XLab documented the related Kimwolf botnet using ENS-based C2 late last year. Dysphoria couples the same resolution model with a relay mesh built from its own victims. The shift complicates a conventional server seizure, but it does not remove infrastructure from the chain: the botnet still depends on blockchain records, reachable distribution nodes, and compromised relays. Japan's NICT independently documented the same JackSkid-to-ENS/SNS shift in May, and, like Nokia and Comcast, found code and strings shared with several other botnet families. That overlap points to shared tooling rather than proof of a single operator, and none of the researchers name one. XLab and CNCERT say Dysphoria spreads through Telnet and SSH weak-password guessing and a set of known IoT remote-code-execution flaws in routers, gateways, and cameras. One example present in both published lists is CVE-2025-9528, a Linksys E1700 command-injection flaw disclosed in August 2025 with a public exploit. The vendor did not respond to the original report. NVD's CVSS vector rates the flaw as requiring high privileges, and neither publication explains how it fits the botnet's propagation chain. A comparison by The Hacker News found that XLab's post and a mirrored CNCERT notice publish different vulnerability lists despite presenting the same joint research. Both agree that weak Telnet and SSH credentials remain the most consistent way in. XLab says Dysphoria attacks internet-service and gaming targets almost daily, but it names no victims or measured peaks. The storefront advertises attacks of up to about 4 Tbps for tens to hundreds of dollars, but that is an operator claim, not a measured attack. Cloudflare measured a 31.4 Tbps attack from the related AISURU/Kimwolf botnet before the March disruption. CNCERT, XLab, and the earlier JackSkid research name no operator. No independent source has measured a Dysphoria attack peak or confirmed the reported 200,000-device scale.

thehackernews.comJul 27, 2026extracted

FBI, Google Take Down NetNut Proxy Network Used by Cyber Threat Actors

In a large-scale coordinated international operation, the FBI and Google’s Threat Intelligence Group have disrupted NetNut, one of the world's largest commercial residential proxy networks. The network, which security researchers also track as the ‘Popa’ botnet, co-opted over two million consumer devices globally, turning them into traffic-routing relays for cybercriminals and state-sponsored espionage groups. Working alongside industry partners including Lumen Technologies, the Shadowserver Foundation, and the US Internal Revenue Service’s (IRS) Criminal Investigation division, the joint operation targeted the digital infrastructure fueling the massive proxy service and seized hundreds of domains. How the Popa Botnet Turned Smart TVs into Proxy Exit Nodes At the heart of the NetNut residential proxy service was the Popa botnet, an engineered stealth communications layer. By embedding deceptive software development kits into inexpensive, off-brand Android-based smart TVs, streaming media boxes and unofficial apps like the SmartTube client, NetNut hijacked ordinary home electronics. When consumers plugged in these devices, their home internet connections were quietly rented out as residential proxy exit nodes. This allowed malicious traffic to route through legitimate domestic IP addresses, effectively bypassing standard data center blocks and security filters. According to a Google report published on July 2, at least 316 distinct threat clusters utilized NetNut exit nodes to conduct password-spraying campaigns, credential stuffing, advertising fraud and sensitive data scraping in a single week in June 2026. Unlike typical underground botnets operated by covert hacking groups, independent cybersecurity journalist Brian Krebs reported that NetNut could be linked to a commercial enterprise, Alarum Technologies Ltd which is a publicly traded Israeli firm listed on NASDAQ. This reporting is partly based on security investigations by firms like Qurium and Synthient, which both established direct links between Alarum's executive leadership and the original developers of the malicious Popa software defined kit (SDK). While Alarum has historically marketed its software as a consensual bandwidth-sharing tool, independent technical reviews found that hijacked host applications failed to present users with any clear notice or consent prompt. In response to the seizure of certain domains associated with NetNut by the FBI, Alarum Technologies issued the following statement: “Alarum takes this matter seriously and will fully cooperate with law enforcement to ensure any misuse of its infrastructure is thoroughly investigated and those responsible are held to account.” While the Google report does not mention the link to Alarum, the GITG researchers noted that NetNut has “a robust reseller program that allows whitelabeling of its network” and assessed with “high confidence” that many popular residential proxy brands are in fact whitelabeling the NetNut botnet. The company also mentions public reports by Synthient, Spur, Nokia Deepfield and others documenting the use of NetNut to infect devices with variants of Mirai distributed denial-of-service (DDoS) botnets. Google and FBI Deploy Mitigations to Dismantle NetNut Infrastructure To prevent the network from easily rebuilding, Google deployed immediate technical mitigations alongside the FBI's legal actions. The company disabled all Google accounts used by NetNut for malware command-and-control, updated Google Play Protect to automatically warn Android users and disabled apps containing the compromised SDKs. “We believe our coordinated actions have caused significant degradation to NetNut’s proxy network and its business operations, reducing the available pool of devices for the proxy operator by millions,” Google said. The company noted that this action built on the disruption of the IPIDEA proxy network that took place in January 2026. Domain Takedown Confusion The initial phase of the NetNut takedown sparked immediate discussion within the threat intelligence community, with some pointing out that while the FBI's seizure banner appeared on netnut.com, NetNut’s primary commercial domain, netnut.io, temporarily remained active and accessible. Some online commentators suggested law enforcement might have targeted the wrong domain. However, other security experts clarified that both domains are tied to the same operation and noted that while seizing the primary commercial domain may take longer due to registrar and jurisdictional differences, the botnet's backend command-and-control servers were successfully targeted and dismantled, severely degrading the network's overall operations.

infosecurity-magazine.comJul 3, 2026extracted

Google Disrupts NetNut Residential Proxy Network Spanning 2 Million Home Devices

Google has significantly degraded NetNut, one of the biggest networks that turns home devices into rented relays for other people's traffic. Working with the FBI, Lumen, and others, Google's Threat Intelligence Group (GTIG) said this week it had reduced the network's pool of usable devices by millions. Google identifies NetNut, also tracked as Popa, as a network spread across home devices worldwide, including smart TVs and streaming boxes, and GTIG estimates the network holds at least 2 million devices. If one of those devices is in your home, strangers can route their own traffic through your internet connection, and your address gets the blame for whatever they do with it. How It Works A residential proxy network sells access to real home internet addresses. Attackers pay to route their traffic through your connection so it looks like ordinary home browsing, not the datacenter traffic that security tools tend to block. To build that pool, operators need their code running on home devices. Some devices ship with it pre-installed on cheap off-brand hardware; others pick it up when someone installs a free app that hides it. Once it is running, the device becomes an "exit node," a doorway that other people's traffic flows through. Google says an exit node brings outside traffic inside the home network, giving attackers a foothold to reach other devices on it. Some of these home gadgets have also been pulled into large attack botnets such as Mirai and Badbox 2.0. In a single week in June, GTIG counted 316 distinct threat clusters using suspected NetNut exit nodes, including cybercriminal and espionage groups, to hide their real location and run password-guessing attacks. The Company Behind It Unlike most proxy botnets, NetNut traces back to a public company. In June, researchers at Qurium, Synthient, Nokia Deepfield, and Spur tied Popa to NetNut. NetNut is a proxy provider owned by publicly traded Israeli company Alarum Technologies (NASDAQ: ALAR). In a controlled test, Synthient said traffic it sent into NetNut's commercial gateway came out through a device it had enrolled in Popa. Synthient framed that as evidence of the traffic path, not proof of what NetNut knew or intended. Google's own intelligence aligns: it treats NetNut and Popa as the same network, and says the public reporting matches its view of how NetNut builds its botnet. The Hacker News covered the researchers' findings when they were published. Alarum rejects the "botnet" label. It calls the research "demonstrably inaccurate assertions and flawed deductions rather than verified facts," and says its software is for consented bandwidth-sharing that does not compromise the devices it runs on. The researchers' testing complicates that defense: Synthient reported that none of the more than 20 apps it examined actually showed users a consent prompt. Why One Takedown Isn't Enough Cutting off NetNut is messy by design. NetNut runs a reseller program that lets other companies sell its network under their own brand names. Google says it has high confidence that many popular, seemingly separate proxy brands are really reselling the same NetNut pool. So a single takedown ripples across a lot of brands that look independent but are not. That is also why Google calls this degradation, not a kill. It says its earlier action against a similar IPIDEA network showed these networks can look resilient: operators start buying capacity from rivals, in effect becoming resellers themselves. Real, lasting damage, Google says, means going after several connected providers at once. In January, Google and partners disrupted IPIDEA, a China-based network that at its peak was one of the largest of its kind. In July 2025, Google took the operators of Badbox 2.0 to court, the botnet of hijacked Android TV devices whose components overlap with Popa. Each time, the networks proved stubborn. What Consumers Should Do The single clearest warning sign is an app that offers to pay you for your "unused bandwidth" or for "sharing your internet." That is one of the main ways these networks grow. Beyond that: Stick to official app stores, and check what permissions a VPN or proxy app is asking for. Keep built-in protections like Google Play Protect switched on. Buy streaming boxes and smart TV hardware from known manufacturers, not no-name brands. The demand for these home addresses does not disappear when a network goes down; it just moves. For defenders and platforms, the next signal to watch is whether NetNut-linked traffic resurfaces under reseller brands. UPDATE Alarum has since responded on the record to the takedown. Omer Weiss, corporate legal counsel for Alarum, says the company and NetNut were made aware of the FBI's seizure of some of its domains on July 2, 2026. Weiss says Alarum "takes this matter seriously and will fully cooperate with law enforcement to ensure any misuse of its infrastructure is thoroughly investigated and those responsible are held to account."

thehackernews.comJul 2, 2026extracted

⚡ Weekly Recap: Linux Kernel Flaws, AI Malware Tricks, Turla Backdoor, Infostealers and More

This week was a reminder that attackers do not always need big tricks. One small mistake, one old access path, one missed patch, and suddenly the door is open. The noise is not all noise, either. Forums are talking, researchers are finding easy cracks, and defenders have more cleanup waiting. Here’s the full Monday recap. ⚡ Threat of the Week New DirtyClone Linux Kernel Flaw Lets Local Users Gain Root via Cloned Packets — Cybersecurity researchers detailed a new variant of the Dirty Frag Linux kernel flaw. Called DirtyClone (aka CVE-2026-43503), it allows local users to gain root privileges via cloned packets. The exploit works successfully on Debian, Ubuntu, and Fedora systems with default namespace configurations. "Any local user on a server or device running a vulnerable kernel who holds or can acquire the CAP_NET_ADMIN capability (frequently obtainable via unprivileged user namespaces) [is exploitable]," JFrog said. "This poses the highest risk to multi-tenant cloud environments, Kubernetes clusters, and containerized workloads where user namespaces are enabled, or privileged containers are deployed." Building Securely with AI: Takeaways from Chainguard Innovation Week Reactive network operations slow teams down and increase business risk. Join Tines and Netskope to discover a practical five-step framework for improving visibility, accelerating response, and creating secure, reliable operations across modern hybrid environments. Explore Innovation Week ➝ 🔔 Top News Critical PTC Windchill PDMlink and PTC FlexPLM Flaw Exploited — A critical remote code execution vulnerability impacting PTC Windchill PDMlink and PTC FlexPLM enterprise Product Data Management (PDM) and Product Lifecycle Management (PLM) software has come under active exploitation in the wild to deploy JSP web shells on susceptible systems. The vulnerability, tracked as CVE-2026-12569, is a case of improper input validation that could allow an attacker to execute arbitrary code by sending a malicious request to the network. Patches for the vulnerability have been released. OpenAI Previews GPT-5.6 Sol, Terra, and Luna — OpenAI officially unveiled GPT-5.6 Sol, Terra, and Luna, with Sol described as the most capable model yet for cybersecurity. The models are being released in a staggered manner with approval from the U.S. government. The release came days after the company released an improved version of its GPT‑5.5‑Cyber model to trusted defenders as part of the Daybreak initiative and launched a new project called Patch the Planet in collaboration with Trail of Bits to help secure open-source projects. OpenAI has also warned about the dual-use nature of the technology, acknowledging that the same capability that helps a red teamer find a zero-day can also assist a bad actor in exploiting one, and that it will prioritize patching jailbreak techniques against the model. In addition, it has framed the effort as getting the tools in the hands of more defenders before attackers gain the same edge. Much of the concern surrounding the frontier models stems from the fact that artificial intelligence can now identify existing bugs within codebases and work towards creating exploits for them. While the automation of cybercrime is not new, these tools undoubtedly have the potential to further lower the barrier to entry for bad actors. New Gaslight macOS Malware Discovered — A newly discovered macOS malware dubbed Gaslight is designed to confuse AI-assisted malware analysis tools through embedded prompt injection strings and fake debugging data within the executable. With cybersecurity researchers using AI-powered tools to assist with malware analysis and reverse engineering, the malware attempts to gaslight such tools into thinking there is some issue, potentially causing them to abort, truncate, or refuse an analysis of the artifact. Gaslight has been attributed with high confidence to a North Korean-linked threat actor. The malware itself is a Rust binary with backdoor and information-stealing functionality, enabling the operator to gain a persistent foothold over the infected host. The findings highlight how threat actors are experimenting with anti-analysis methods designed specifically to bypass AI-assisted security platforms. Turla Uses STOCKSTAY Backdoor in Ukraine Attacks — The Russian state-sponsored threat actor known as Turla has leveraged a previously undocumented .NET backdoor called STOCKSTAY in attacks targeting government and military organizations in Ukraine, and entities that have an interest in Italian foreign policy. STOCKSTAY shares significant code and functional overlaps with Kazuar, a staple implant put to use by the adversary since 2017. Suspected development activity of malware dates back to December 2022. Amadey, StealC Malware Operations Disrupted in Operation Endgame — A coordinated law enforcement operation, in partnership with private sector companies, dismantled criminal infrastructure powering Amadey and StealC. According to Europol, the operation led to the disruption of 326 servers and 142 domains, the identification of more than €41 million ($47 million) in cryptocurrency linked to criminal activity, and the recovery of approximately 27 million credentials stolen from over 385k compromised systems. Amadey and StealC are sold to cybercriminals under a malware-as-a-service (MaaS) model. Microsoft said criminals use Amadey to gain an initial foothold on victim devices to deploy additional malware, such as StealC, which then steals credentials, cryptocurrency wallets, and other sensitive information that can later be sold or leveraged in follow-on attacks. The two malware families were linked to more than 140,000 infected devices during the first two weeks of May 2026 alone. That said, no arrests were announced as part of the operation. ️🔥 Trending CVEs Bugs drop weekly, and the gap between a patch and an exploit is shrinking fast. These are the heavy hitters for the week: high-severity, widely used, or already being poked at in the wild. Check the list, patch what you have, and hit the ones marked urgent first — CVE-2026-47729 aka Squidbleed (Squid), CVE-2026-12957 (Amazon Q Developer), CVE-2026-12569 (PTC Windchill PDMlink and PTC FlexPLM), CVE-2026-43503 aka DirtyClone, CVE-2026-46331 aka pedit COW (Linux Kernel), CVE-2026-30040, CVE-2026-30041 (FastStone Image Viewer), CVE-2026-45585 (Microsoft WinRE), CVE-2026-8461 aka PixelSmash (FFmpeg), CVE-2026-55200 (libssh2), CVE‑2026‑20971 (Samsung KNOX kernel), CVE-2026-10086, CVE-2026-10712, CVE-2026-12053 (GitLab CE and EE), CVE-2026-13028, CVE-2026-13032, CVE-2026-13033, CVE-2026-13038 (Google Chrome), CVE-2026-53605 (Reachy Mini Wireless image), CVE-2026-13136, CVE-2025-15660, CVE-2026-13135 (Synology MailPlus Server), CVE-2026-11374 (ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus and ADAudit Plus), and a critical Infoblox NIOS privilege escalation vulnerability (no CVE). 🎥 Cybersecurity Webinars Stop AI-Driven Cyberattacks Before They Stop Your Business → Hackers are now using AI to launch cyberattacks at machine speed. If your defenses are built for human-speed threats, you are at risk. Join this webinar to get a step-by-step blueprint to fight back. Learn exactly how to block AI-driven attacks and protect your company before a crisis hits. When AI Goes Rogue: How to Secure the New Cyber Attack Surface → As companies rush to adopt AI, hackers are turning these tools into a massive liability by hijacking AI agents and leaking trade secrets. Join this urgent webinar to see exactly how attackers weaponize AI against businesses. You'll get a practical blueprint to lock down your setups, fix risky configurations, and stop your own tech from going rogue. Building at Machine Speed: How to Secure AI Software Delivery → AI tools are generating code faster than security teams can review it, introducing hidden risks into software pipelines. Join this webinar to learn how to catch vulnerabilities and govern AI risk without slowing down development. You'll get a practical roadmap to protect your software supply chain and scale AI engineering safely. 📰 Around the Cyber World China's New Zhipu AI Reportedly Matches Claude Mythos in Vulnerability Discovery — The Wall Street Journal reported that a new model released by China's Zhipu AI, GLM-5.2, matches the performance of Anthropic Mythos when it comes to finding vulnerabilities, narrowing the gap between top U.S. models and those developed by Chinese companies. The ability of AI systems to autonomously find security defects in software has created new urgency to efforts that entail the use of models to quickly close them before they can be exploited by bad actors. There are also worries that these models, in the wrong hands, can become potential enablers of cyber warfare. The Trump administration has called for the creation of a framework that grants the federal government the ability to evaluate AI models' capabilities and determine which qualify as "covered frontier models," a designation for AI systems with advanced cyber capabilities. Indirect Prompt Injection in Agentic Coding Tools — Mozilla's Zero Day Investigative Network (0DIN) characterized indirect prompt injection as a "very real and serious attack vector that can result in catastrophic damage, much of which will be irreversible." In the case of agentic IDEs and coding agents, they can request access to various tools, which, once approved, can pave the way for code execution, file system operations, and network calls. Specifically, an attacker can obtain code execution using a seemingly harmless repository by chaining trusted setup instructions, routine error handling, and automated agent behavior. The attacker-controlled repository does not even have to contain any malicious code. Instead, it's fetched at runtime from a DNS TXT record by framing it as an essential step during the installation phase when a developer copies the repository link and instructs the agent to get it running. "In short, agentic coding tools have access to everything they need for this: private data, including environment variables, credentials, API keys, and local configuration files," 0DIN said. "Untrusted content, such as repositories, documentation, and error messages from recently installed packages, can inject malicious models to steal this data." New KuinaExtractor Rust Infostealer Spotted — A new Rust-based information stealer called KuinaExtractor comes fitted with capabilities to harvest web browser data, crypto wallets and credentials for services such as Roblox, Steam and Discord. Said to be in active development since December 2025, the stealer also includes a Chrome app-bound encryption (ABE) bypass. In parallel, the malware developer worked on two short-lived projects known as KuinaCookieExtractor and Zenith C2 before they were abandoned. KuinaCookieExtractor goes beyond browser cookies to include Roblox and Steam sessions, Minecraft and FileZilla logins, Telegram tdata and Discord tokens, and exfiltrates over a Discord webhook rather than Telegram. New LokiBot Campaign Surfaces After a Hiatus — A new email phishing campaign has been observed delivering LokiBot via a JavaScript attachment. Once launched, the script triggers the execution of a PowerShell loader that runs a .NET injector payload that deploys the LokiBot malware. LokiBot is capable of harvesting credentials from password managers like 1Password, Enpass, and KeePass, and contacts an external server to receive and execute commands. Phishing Campaign Drops Malicious Chrome Extension — Invoice-themed email phishing lures written in Italian are being used to launch JavaScript attachments masquerading as PDF documents. "The most interesting part of this infection was not the initial JavaScript. The malware installed a malicious Google Chrome extension and paired it with a Native Messaging Host," D3 Lab said. "This combination allowed code running inside Chrome to request PowerShell commands on the Windows system." Time as an Attack Surface — New research from NCC Group has argued the need for treating time as a "first‑class attack surface," stating clock drift, time synchronisation failures, and deliberate oscillator manipulation can be exploited to undermine cryptography, authentication, industrial automation, and safety systems. "The risk is amplified by broader technological trends," NCC Group's Andy Davis said. "Cloud computing, containerisation, and virtual machines abstract time away from physical hardware, placing it under the control of hypervisors and orchestration layers. At the same time, Industrial Control Systems, IoT devices, and safety-critical platforms increasingly rely on low‑cost oscillators and commodity components that are vulnerable to environmental influence and physical manipulation. Systems that once relied on isolated, deterministic timing sources are now interconnected, synchronised, and exposed." Threat actors Exploit Xiongmai DVR Flaw to Deliver Proxy SDK — Threat actors have been exploiting CVE-2024-3765, a vulnerability in Xiongmai DVR, to deploy commercial residential proxy SDKs using a Mirai botnet-derived HTTP downloader. "All DDoS and scanning capability has been stripped," the Nokia Deepfield Emergency Response Team (ERT) said. "What remains is a minimal HTTP client and an embedded userspace ELF loader – Mirai reduced to a delivery truck." The main stager installed following a successful compromise deploys a proxy binary called PacketSDK, which is part of the IPIDEA residential proxy network disrupted by Google earlier this year. The stager also contains a remote code execution backdoor that polls an external server for updates every 2 minutes. Nation-State Targeting of Water Systems — DomainTools warned that water and wastewater infrastructure have become strategic pressure points for state and state-aligned actors from China, Iran, and Russia. "The combination of chronic underinvestment and weak baseline operational technology (OT) security makes many of these critical systems easy to compromise," the company said. "Such intrusions can have both physical and psychological impact, and disruptions often affect civilian life, public health, and trust in government." Anthropic Accuses Alibaba of Obtaining Illicit Access to Claude — Anthropic has accused the Chinese company Alibaba of what it described as the "largest campaign to illicitly extract Claude's capabilities." The attacks occurred between April 22 and June 5, 2026, when "operators afﬁliated with Alibaba and Alibaba Qwen, Alibaba's AI lab," allegedly generated "more than 28.8 million exchanges with Claude through almost 25,000 fraudulent accounts," per Anthropic. The distillation campaign targeted its capabilities, such as agentic reasoning, software engineering, and long-horizon tasks, while evading detection using obfuscation techniques and proxy networks. Linux Foundation Unveils Akrites and OSERA — The Linux Foundation has announced Akrites as a coordinated effort to address and disclose vulnerabilities in critical open-source software as AI accelerates both the scale and speed of vulnerability discovery. "The initiative provides a single, trusted place to coordinate, remediate, and disclose, with a shared SIRT [Security Incident Response Team] serving as a predictable partner for maintainers rather than a flood of uncoordinated reports," the foundation said. The initiative also plans to work with critical infrastructure operators to help deploy fixes before in-the-wild exploitation. The Linux Foundation has also announced its intent to form an Open Source Enterprise Resiliency Alliance (OSERA) that aims to strengthen the open-source components that underpin the financial services sector through a vendor-neutral, upstream-aware approach. "OSERA complements the recently announced Akrites, the cross-industry effort enabling coordinated disclosure and upstreaming," the foundation said. "As financial-services downstream complement to Akrites, OSERA will collaborate with Akrites in the upstreaming process and, together with the Open Source Security Foundation, to represent the voice of the industry in defining remediation standards." Microsoft Extends Windows 10 Consumer Extended Security Updates by a Year — Microsoft quietly extended the Extended Security Updates (ESU) program for Windows 10 consumers by a year, letting eligible users get updates through October 12, 2027. To enroll in the consumer Windows 10 ESU program, devices need to be running Windows 10, version 22H2 Home, Professional, Pro Education, or Workstations edition and cannot be offered for devices in kiosk mode or those that are joined to an Active Directory domain or Microsoft Entra and/or enrolled in a Mobile Device Management (MDM) solution. Microsoft's Secure Boot Certificates Have Expired — In related Microsoft news, the certificates that manage UEFI Secure Boot trust – namely, Microsoft Corporation KEK CA 2011, Microsoft UEFI CA 2011, and Microsoft UEFI CA 2011 -- expired on June 24 and 27 2026. A third certificate, Microsoft Windows Production PCA 2011, will expire on October 19, 2026. "Many Windows PCs manufactured since 2024 already have the updated 2023 certificates," Microsoft said. "For the remaining devices, Microsoft is delivering new Secure Boot certificates through Windows monthly updates, with partner original equipment manufacturers (OEMs) making firmware updates available to help ensure compatibility." Google Cloud has also released guidance on how to update Compute Engine Shielded VM instances to trust the updated Microsoft Secure Boot certificates for UEFI Secure Boot. To apply Secure Boot certificate updates for Linux on Azure virtual machines, it's recommended to follow the actions outlined by Microsoft here. Separately, Linux users are advised to update their shims to the latest versions signed by the new key. It's important to note that devices that haven't received the newer 2023 certificates will continue to function normally, and standard Windows updates will continue to install. However, these devices will no longer receive new security protections for the early boot process, including updates to Windows Boot Manager, Secure Boot databases, revocation lists, or mitigations for newly discovered boot-level vulnerabilities. Fake OpenAI Organization Invites Used in New Poisoned Tenant Campaign — Phishing emails are being sent from threat actor-controlled ChatGPT tenants, inviting recipients to join an organization with the likely goal of harvesting sensitive information shared in the AI chatbot. "The emails came from OpenAI's legitimate notification address ([email protected]), passed all standard email authentication checks, and referenced our company by name," Push Security said. "They looked exactly like a routine organizational invitation because, technically, they were one." The development comes as threat actors are abusing AI chatbot chat sharing functionality to distribute pages containing malicious instructions, turning them into malware delivery platforms. "The attacker has used ChatGPT's code rendering feature to build a fully designed fake page that mimics a ChatGPT service disruption, redirecting victims to a convincing clone of ChatGPT's download page that delivers a malicious executable," Push Security noted. The activity has been codenamed LLMShare. 🔧 Cybersecurity Tools Sulla → It is an open-source security tool by Praetorian that scans internal network SMB file shares to find exposed credentials and sensitive data. Operating as a fast, low-noise static binary, it maps Active Directory environments and uses multi-layered filtering with the Titus engine to perform in-memory analysis for cloud keys, passwords, and tokens. It outputs structured, real-time results to help security teams identify and remediate internal data exposure before it can be exploited. Karna → It is a Web Application Firewall (WAF) module specifically engineered for the Kong Gateway to provide modern, scalable security for web applications. By integrating directly into the Kong ecosystem, it allows organizations to enforce fine-grained security policies and filter malicious traffic at the gateway layer, ensuring that protection is applied consistently across distributed services without adding significant latency. Disclaimer: This is strictly for research and learning. It hasn't been through a formal security audit, so don't just blindly drop it into production. Read the code, break it in a sandbox first, and make sure whatever you’re doing stays on the right side of the law. Conclusion This week, keep it simple. Break the small thing, find the forgotten access, wait for someone to say they meant to patch it. No genius required. Just old mistakes with fresh damage. Shut the door. Check the locks.

thehackernews.comJun 29, 2026extracted

‘Popa’ Botnet Linked to Publicly-Traded Israeli Firm

For the past four years, a sprawling Android-based botnet called Popa has forced millions of consumer TV boxes to relay Internet traffic linked to advertising fraud, account takeovers, and mass data-scraping efforts. This week, researchers from multiple security firms concluded that the Popa botnet is linked to NetNut, a “residential proxy” provider operated by the publicly-traded Israeli firm Alarum Technologies Ltd [NASDAQ: ALAR]. Popa is a massive botnet, but by all accounts it is unlike traditional botnets that enlist compromised systems in destructive activities, such as coordinating huge distributed denial-of-service attacks. Rather, Popa appears designed with a singular purpose: Implementing a persistent communications layer capable of registering a device, maintaining long-lived encrypted connections, and opening communication tunnels on demand. Experts say Popa is a plugin component associated with the Vo1d botnet, a large-scale malware campaign targeting unofficial Android-based TV boxes. These devices, which are marketed under thousands of brand names and model numbers and broadly available for purchase at top e-commerce destinations, all advertise the ability to stream hundreds of subscription video services for an up front one-time fee. But as the FBI and security industry experts have warned repeatedly, these streaming boxes typically bundle or come pre-installed with software that turns the user’s TV into a “residential proxy” — allowing anyone to route their Internet traffic through that device for as long as it remains plugged into a wall socket and connected to a local network. More concerning, some of these proxy networks do little to stop malicious customers from communicating with and even compromising systems on the local network of the unsuspecting device owner. The first clues about Popa’s origins came in a 2025 report from the Chinese security company XLAB, which flagged at least nine domain names that were used to register and direct the activities of compromised devices. In a report released today, the security firm Qurium described how it stumbled on some of those same domains while investigating a series of disruptive and expensive data scraping events targeting the company’s hosted organizations in May 2026, in which the scraping activity was scattered evenly across more than 1.4 million Internet addresses. Qurium said it found several dozen domains used to control Popa that were all hosted in lockstep across multiple Internet addresses over time, including gmslb[.]net, safernetwork[.]io, tera-home[.]com, and ninjatech[.]io. Digging deeper, Qurium discovered gmslb[.]net was referenced in dozens of pirated or modded video content streaming apps, such as CRICFy, DooFlix, Sprozfy, RTS Tv, Flixoid, CyberFlix, Rapid Streamz, TvMob and HD/OceanStreams. Qurium’s report notes that most of the domains long used to control the Popa botnet were seized or dismantled in July 2025, after Google, HUMAN Security and Trend Micro teamed up to disrupt Badbox 2.0, a botnet that is closely associated with Vo1d. Qurium said that immediately after that disruption, several dozen new domains were registered to serve as controllers for the Popa botnet, but that one of those control domains was not new: ninjatech[.]io. Ninjatech is a company founded by Moishi Kramer, whose LinkedIn profile says he is vice president of research and development at NetNut. That resume credits Kramer for helping NetNut to build from the “ground up,” “designing the architecture,” and “scaling the NetNut” before the company was acquired by Alarum Technologies. A self-created listing at the job board F6S references Kramer as the sole owner of the Ninjatech domain (a screen capture of it is pictured below). Responding via email, Mr. Kramer said Ninjatech ceased operations approximately five years ago, when the company sold a software development kit (SDK) called Popa that was designed to use a small portion of a device’s bandwidth and to run only after the host application obtained user consent. “That code was sold and licensed to third parties including resellers years ago,” Kramer said. “Once software is distributed that way, the original developer has no control over how others later modify, rebrand, or deploy it.” Kramer said neither he nor NetNut builds, operates or maintains the infrastructure being described as Popa, nor does he control the Ninjatech domain. “I didn’t register the June 2025 domains you mention, and I don’t know who did,” he continued. “I have no control over, or visibility into, that infrastructure. I can only tell you it isn’t operated by me or by NetNut.” But in a separate Popa research report released today, the proxy-tracking company Synthient said a recent analysis of the Popa SDK revealed outbound traffic clearly associated with NetNut. “The research team assesses with high confidence that devices running Popa forward traffic from Netnut clients,” Synthient wrote. “This proves without a shadow of a doubt that Popa actively continues to be used by NetNut as part of their proxy pool.” Alarum Technologies, NetNut’s Tel Aviv-based parent company, said the reports by Synthient and Qurium contained “demonstrably inaccurate assertions and flawed deductions rather than verified facts.” Alarum shared a statement saying they reject the basic characterization of the SDKs and technologies discussed in the reports as a “botnet.” “The SDKs at issue are designed to facilitate bandwidth-sharing functionality and do not transform user devices into malware-controlled systems or otherwise compromise the devices on which they operate,” the statement reads. “Netnut operates a commercial proxy network and maintains policies, procedures, and technological measures designed to promote lawful and responsible use of its services.” Alarum said NetNut places “significant emphasis on appropriate notice and consent mechanisms, conducts customer due diligence, monitors for potential misuse, and takes steps intended to detect and mitigate suspicious or unauthorized activity.” “This method of operation is supported both by internal procedures and policies, including performing KYC checks and additional due diligence of NetNut’s customers, as well as employing various technological measures, designed to assist in identifying and addressing suspected misuse of the network,” their statement continued. However, in a report released on June 8, the proxy tracking service Spur asserted that NetNut does not require corporate verification or meaningful “know your customer” procedures before allowing customers to purchase proxy access. “An individual can sign up, pay, and route traffic through partner address space, including space belonging to institutions whose users never opted in,” Spur wrote. “The ‘verified corporations only’ claim is simply marketing for bandwidth sellers, not an access control on who actually uses the proxies.” “Nor is NetNut the only front door,” Spur continued. “A number of downstream white labelers and resellers repackage the same ISP proxy pool under their own brands. These outlets typically perform no KYC at all, less scrutiny than NetNut itself, who at the very least might assign an account manager to potential users. Anyone who knows where to look can buy access through a reseller with nothing more than a burner email address and $5 in crypto.” Synthient found that although the most recent builds of Popa (as of three months ago) have added the ability to ask the user for consent before installing proxy components, not all variants or previous versions of Popa contain this functionality. “Of the over 20 genuine Popa publishers analyzed, none of them were observed asking for user consent,” Sythient wrote. THE PREVALENCE OF POPA Chris Formosa is senior lead information security engineer for Black Lotus Labs, a division of the Internet backbone carrier Lumen Technologies. “What especially makes Popa dangerous is just how widely used NetNut is for reselling and sharing,” Formosa said, explaining that many other proxy services simply resell NetNut proxies rather than building out their own far-flung proxy networks. “So these Popa IPs appear in tons of different services all over the ecosystem, which makes it one of the most problematic and dangerous proxy botnets on the market currently.” Formosa said the Popa botnet averages between 1.5 million to 2.5 million distinct IP addresses each day, relying on between 250 and 300 Internet addresses that are used to direct its activities. “That’s why Popa is so dangerous,” Formosa said. “It may not be the largest botnet we have seen, but it is spread all over the industry, making its power very amplified.” Formosa said while that makes Popa one of the larger botnets out there today, its numbers pale in comparison to those previously boasted by IPIDEA, a China-based proxy provider that until recently operated a daily pool of nearly 10 million devices that they resold as proxies to anyone. In January 2026, Synthient published research showing that multiple new large DDoS botnets had grown rapidly by tunneling through IPIDEA proxies into the local networks of unsuspecting TV box owners and infecting other Android-based devices behind the user’s firewall. IPIDEA is based largely on SDKs used to view pirated streaming content on a vast number of TV box devices, but the service’s numbers have dwindled since January, when Google and industry partners took legal action to seize domain names that IPIDEA used to control devices and proxy traffic through them. Jérôme Meyer, a security researcher at Nokia Deepfield, said the total population of devices participating in the Popa botnet may be far higher than Lumen’s estimates. Meyer told KrebsOnSecurity that Nokia is monitoring 26 of at least 359 known relay nodes for the botnet, and estimates that each relay node handles between 35,000 and 60,000 clients simultaneously. “On the relay node subset I am looking at (26 of them), 750,000 unique sources in 24 hours,” Meyer wrote in response to questions. Nokia Deepfield released its own report today on RoboVPN, a VPN app tied to the Vo1d botnet’s Popa plugin that Qurium attributes to NetNut/Alarum Technologies. THE SYMBIOSIS OF PROXIES AND DATA SCRAPING Experts say many of the world’s largest proxy providers have updated their public-facing branding to highlight their utility for training AI platforms, implying it is a primary use case for their residential proxies. That’s because AI services tend to rely on constantly mass-scraping the Internet for new text, images and video content that can be used to train large language models (LLMs). “AI companies depend on web-scraped content: for pre-training, for retrieval, for agent grounding, for search,” reads a report this month from Include Security that examines the prevalence of proxy SDKs in smart TV apps. “But the modern web isn’t scrapeable from a datacenter. Cloudflare, DataDome, HUMAN, among others throttle or block requests from known cloud IPs. The workaround is residential proxies. A scraping job routed through a Comcast or T-Mobile subscriber’s connection arrives at the target site from an IP that belongs to a paying residential customer.” This non-stop content scraping has spawned more than 70 copyright infringement lawsuits against major tech companies that have acknowledged large-scale data scraping as a major source of the “brains” behind their commercial AI offerings. Ironically, much of that scraping is being aided by proxy services that are intimately tied to unofficial Android TV boxes and associated SDKs whose stated purpose is streaming pirated content. The scraping activity has become so aggressive that it often overwhelms the targeted websites, preventing them from being reachable by legitimate visitors. In many reported cases, nonprofit organizations, libraries and universities have complained of constantly battling to keep their services online in the face of relentless data-scraping firms hiding behind residential proxy services. A survey conducted last year by the Confederation of Open Access Repositories (COAR) found while some content scraping bots are rather innocuous, “others are sufficiently aggressive that they are increasingly causing service disruptions in repositories and other scholarly communications infrastructures.” More than 90 percent of survey respondents indicated their repository is encountering aggressive bots, usually more than once a week, and often leading to slow downs and service outages. “Automated web scraping is nothing new, and has been the key technology underlying search engines such as Google for over 30 years,” wrote Brendan O’Connell, platform manager at the Directory of Open Access Journals (DOAJ), a free, community-curated index of peer-reviewed academic journals. “However, the current investor-fueled AI startup craze means there are now thousands of well-funded companies developing and deploying their own scraping tools to train AI models, alongside existing major players like OpenAI and Google.” DON’T TOUCH THAT DIAL! Across the United States, local communities are pushing back against the proliferation of new data centers aimed primarily at improving the capabilities of AI. But security experts say the general public remains largely unaware that using one of these unsanctioned Android TV boxes means their “smart TV” is almost certainly using a significant amount of bandwidth each month to help train modern AI models. Even households without these sketchy TV boxes can still have their smart TVs turned into residential proxy nodes, just by downloading one of thousands of apps made available on Samsung and LG smart TVs. Spur said it recently scraped the LG and Samsung app stores and found that each had approximately 3,000 apps available for download. Many of these apps are simple games or utilities that state in the fine print that the user’s Internet connection will be used to download data and that they can opt out at any time. Spur said it found that more than 42 percent of apps available for download via the webOS operating system on LG smart TVs include SDKs that turn one’s television into an always-on residential proxy node. More than a quarter of the apps made for Samsung’s Tizen operating system had similar residential proxy components, Spur found. Experts say it’s questionable whether TV apps with proxy SDKs can obtain meaningful consent from users for installing an always-on proxy connection, particularly when anyone in a household — including children — can effectively opt the family TV into a residential proxy network just by installing a simple game or app. “Privacy-policy disclosure is the wrong control surface for a TV,” Include Security wrote. “It is hard to scroll through a legal document navigated by arrow keys on a remote, and the in-app consent dialog doesn’t convey that a paying customer is about to route their scraping traffic through the user’s home internet.” Spur’s head of research Sean Simmons told KrebsOnSecurity that most people do not have a working mental model for what it means to sell access to their residential IP address, no matter what device they are using. “And on a TV, the gap is even wider,” Simmons said. “A one-time prompt navigated with a remote can disappear into the setup flow, while the app keeps monetizing the connection long after anyone remembers what they accepted.” Simmons said LG and Samsung should follow the lead of other TV platforms that have already drawn a line against residential proxy providers, pointing to policies by Amazon that prohibit apps facilitating proxy services for third parties. Likewise the TV streaming device maker Roku reportedly now bars developers from using proxy SDKs and has removed apps that bundled them. Apps that turn one’s device into a residential proxy node are not limited to smart TVs and no-name streaming boxes, of course. As noted by the security firm Infoblox, mobile app developers can embed SDKs provided by the residential proxy networks into their products to monetize their software, allowing them to receive a small amount of money on each installation. The result, Infoblox said, is that devices are frequently enrolled without the owner’s knowledge, typically through free applications such as VPNs, streaming apps, screensavers and “productivity” apps such as PDF viewers and break reminders. All too often, these proxy services are beaconing out from employee devices brought into the workplace, Infoblox found. In a blog post earlier this month, Infoblox said it discovered that fully 65% of its customer base was querying one or more residential proxy related domains. “We saw steady growth in these queries in 2025, with a 25% increase over the year to over 500 billion per month,” Infoblox wrote. “Over 90% of our pharmaceutical and food & beverage customers have queried residential proxy indicators. Perhaps even more concerning is that over 60% of government and banking customers have as well.” Infoblox researchers Nick Sundvall and David Brunsdon warned that with residential proxies in the corporate environment, external access is granted to an organization’s IP space. “If threat actors were to abuse the residential proxy to attack a third party, the third party’s incident response would, correctly, identify your residential proxy as the source,” they wrote. “Untangling that, by proving that you were the conduit and not the threat actor, costs time, creates legal exposure, and can damage your reputation. The stunning prevalence of these services within customer environments warrants attention from both network defenders and policy makers who should consider how the risks posed by residential proxies could be impacting their security posture.”

krebsonsecurity.comJun 18, 2026extracted

In Other News: Google Security Layoffs, AudiA6 Takedown, $400 Million Coupang Fine

SecurityWeek’s weekly cybersecurity news roundup offers a concise overview of important developments that may not receive full standalone coverage but remain relevant to the broader threat landscape. This curated summary highlights key stories across vulnerability disclosures, emerging attack methods, policy updates, industry reports, and other noteworthy events to help readers maintain a well-rounded awareness of the evolving cybersecurity environment. Here are this week’s highlights: IBM and AT&T accused of hack cover-ups A former IBM cybersecurity executive has filed a lawsuit accusing IBM and AT&T of covering up repeated foreign government-linked hacks on their systems. According to the whistleblower, the companies failed to properly disclose multiple breaches to the US government over several years. He alleges they instead provided false assurances about their security posture to secure and maintain valuable federal contracts, in violation of legal requirements. University of Oxford impacted by CareerConnect data breach The University of Oxford disclosed a data breach related to the CareerConnect careers service. Hackers accessed the platform and compromised names, email addresses, and encrypted passwords. The incident impacts alumni, research staff, and employer user accounts, but not students, who rely on Single Sign-On (SSO) to log in. Google Threat Intelligence Group and Mandiant layoffs Google Cloud has reportedly initiated a round of layoffs impacting its cybersecurity division, specifically targeting members of the Mandiant team and the Google Threat Intelligence Group (GTIG). Google has not confirmed the exact number of affected employees, and it has not responded to SecurityWeek’s request for comment. Microsoft issues incident response playbook for AI Microsoft has released a new practitioner’s playbook detailing how to investigate security incidents involving Microsoft 365 Copilot and Azure AI Services. The document provides security teams with structured methodologies to track and analyze potentially malicious activity within these environments. The resource is designed to help defenders adapt their traditional response workflows to the unique telemetry of modern AI platforms. CISA mandates patching for actively exploited LiteLLM flaw CISA has added CVE-2026-42271, a critical command injection vulnerability in the AI gateway BerriAI LiteLLM, to its Known Exploited Vulnerabilities (KEV) catalog due to evidence of active exploitation in the wild. There does not appear to be any information on the attacks exploiting the vulnerability. Regulators issue $400 million penalty over Coupang data leak The South Korean Personal Information Protection Commission (PIPC) has imposed a record $400 million fine on Coupang due to widespread security failures and data handling violations that exposed the personal information of more than 30 million customers. Investigations revealed critical deficiencies in access controls and authentication key management. Coupang plans to appeal the fine. Nokia debuts automated edge defense for proxy botnets Nokia has introduced Deepfield Genome Shield, an automated security platform designed to proactively defend against massive DDoS attacks driven by residential proxy botnets. The system mitigates threats from an estimated 200 million compromised devices by disrupting botnet command-and-control communications directly at the network edge. ICS device exposure remains flat as attack surface widens Bitsight’s 2026 Global State of ICS/OT Exposure report indicates that internet-facing industrial control systems (ICS) have plateaued at roughly 170,000 monthly exposures. Despite this flat count, the overall risk profile is expanding because modern ICS increasingly support non-traditional protocols such as SSH, HTTP, and MQTT alongside legacy protocols, widening the attack surface and making defenders’ jobs more challenging. ENISA shifts focus to collective EU resilience The European Union Agency for Cybersecurity (ENISA) is centering its Cyber Europe 2026 exercise on enhancing collective response capabilities across the region. The focus highlights an ongoing effort to evaluate and strengthen the cooperative resilience of EU member states against large-scale cyber incidents. This strategic direction aims to ensure that European infrastructure can withstand and rapidly recover from coordinated, transnational digital threats. Global operation takes down crypto laundering service An international law enforcement coalition supported by Europol and Eurojust has dismantled AudiA6, a prominent cryptocurrency laundering network that laundered over $388 million for ransomware actors between 2022 and 2025. The operation disrupted an industrial-scale scheme that funneled illicit digital assets through thousands of fake exchange accounts opened with stolen identities. Additionally, authorities seized the platform’s web infrastructure and successfully shuttered Dark2Web, an underground cybercrime forum managed by the same operators to connect threat actors globally.

securityweek.comJun 12, 2026extracted

Cybersecurity Act 2, quando una legge diventa un segnale politico. Se l’UE chiude, Pechino è pronta a rispondere

In questo contesto, il Cybersecurity Act diventa qualcosa di più di una legge. È un atto di sovranità, un segnale politico, una dichiarazione di intenti. E, come ogni dichiarazione di questo tipo, genera una reazione. C’è una soglia, sottile ma decisiva, oltre la quale il diritto smette di essere un insieme di norme e diventa una forma di potere. L’Europa sembra averla attraversata con la revisione del Cybersecurity Act: ciò che nasceva come architettura tecnica per la sicurezza informatica si sta trasformando in uno strumento di selezione geopolitica, capace di ridefinire non solo chi può operare nel mercato europeo, ma anche chi può esistere, industrialmente, nel nuovo ordine digitale. La proposta della Commissione europea, parte di un più ampio pacchetto sulla resilienza cibernetica, si muove infatti lungo una direttrice chiara. L’obbiettivo è rafforzare il controllo sulle catene di approvvigionamento ICT, rendere vincolanti strumenti come il 5G Toolbox e introdurre criteri più stringenti per identificare i cosiddetti “fornitori ad alto rischio”. È un passaggio cruciale, perché segna il superamento di una concezione puramente tecnica della sicurezza e l’ingresso esplicito della dimensione politica nella valutazione del rischio. Non è un caso che, pur senza essere nominati formalmente nei testi normativi, i destinatari impliciti siano evidenti. Aziende come Huawei e ZTE vengono considerate da Bruxelles fornitori critici sulla base di valutazioni già maturate nell’ambito del 5G Toolbox, che gli Stati membri sono stati invitati ad applicare in modo più rigoroso. La novità, però, non sta tanto nell’individuazione del rischio, quanto nella volontà di trasformare raccomandazioni politiche in obblighi giuridici, vincolando l’intero mercato europeo a una scelta di campo. Pechino risponde La reazione cinese, ça va sans dire, diventa inevitabile, quasi strutturale. Il Ministero del Commercio di Pechino ha formalmente presentato osservazioni alla Commissione europea, denunciando una “politicizzazione” della cybersicurezza e mettendo in guardia contro possibili contromisure qualora le aziende cinesi venissero discriminate. Non si tratta di una semplice protesta diplomatica ma di un passaggio che richiama, esplicitamente, il quadro normativo internazionale, in particolare le regole del WTO, che secondo la Cina verrebbero violate da criteri ritenuti arbitrari e non tecnici. In questo scambio si intravede, però, un cambiamento più profondo. Ora più che mai, la sicurezza non è una categoria neutra, è diventata una variabile geopolitica, una leva attraverso cui ridefinire le relazioni economiche globali. Quando Bruxelles afferma che il rischio può essere anche “non tecnico”, sta introducendo un principio radicale, per cui la fiducia in un fornitore dipende non solo dalle sue tecnologie, ma dal sistema politico e istituzionale da cui proviene. “Una rottura rispetto al paradigma liberale che ha governato la globalizzazione tecnologica degli ultimi trent’anni“ È una rottura rispetto al paradigma liberale che ha governato la globalizzazione tecnologica degli ultimi trent’anni, fondato sull’idea che il mercato potesse essere separato dalla politica. Un mutamente che interviene mentre le infrastrutture digitali, quali reti 5G, fibra, sistemi energetici connessi, persino scanner di sicurezza, sono diventate la spina dorsale delle società contemporanee, e quindi irrinunciabile terreno di confronto tra potenze. L’Unione europea lo sa bene, e non lo nasconde più. La revisione del Cybersecurity Act, in questo senso, è parte di una strategia più ampia di “sovranità tecnologica”, che mira a ridurre la dipendenza da fornitori extra-europei e a costruire un ecosistema digitale autonomo. Una linea ribadita anche a livello istituzionale, dove si sottolinea la necessità di garantire che ogni prodotto digitale sia sicuro “fin dalla progettazione” e che le catene di fornitura siano resilienti a interferenze esterne. Questo orientamento trova riscontro diretto anche nei documenti ufficiali dell’Unione europea, come il testo del regolamento sul Cybersecurity Act e le attività dell’ENISA, che definiscono un quadro comune di certificazione e gestione del rischio a livello continentale. Parallelamente, anche governi nazionali, incluso quello italiano, hanno rafforzato negli ultimi anni i meccanismi di controllo sugli asset strategici digitali attraverso strumenti come il Golden Power, applicato più volte proprio nel settore delle telecomunicazioni. Fronte o cyber trincea? Ma ogni scelta strategica ha un costo, e nel caso europeo il prezzo si misura in termini di competitività. Gli operatori delle telecomunicazioni, pur condividendo l’obiettivo della sicurezza, temono l’impatto economico di una riduzione forzata dei fornitori, che potrebbe tradursi in un aumento dei costi infrastrutturali e in un rallentamento degli investimenti. È il paradosso di una politica industriale che, nel tentativo di proteggere il sistema, rischia di indebolirne la capacità competitiva nel breve periodo. La questione è particolarmente delicata in paesi come l’Italia, dove si è resa significativa la presenza di tecnologie cinesi nelle reti e solo progressivamente ridotta negli ultimi anni, attraverso una transizione verso fornitori europei come Ericsson e Nokia. Questo processo, già in atto, potrebbe accelerare sotto la pressione normativa europea, ma non senza tensioni tra esigenze di sicurezza e sostenibilità economica. In controluce, ciò che emerge è la progressiva costruzione di blocchi tecnologici. Da un lato l’Occidente, che tende a integrare sicurezza, regolazione e alleanze strategiche; dall’altro la Cina, che difende un modello alternativo basato su controllo statale e integrazione verticale delle proprie filiere industriali. Il rischio, sempre più concreto, è la frammentazione dello spazio digitale globale in sfere di influenza separate, dove standard, tecnologie e fornitori non sono più interoperabili ma politicamente connotati. “Il Cybersecurity Act diventa qualcosa di più di una legge“ Ecco perché, in questo contesto, il Cybersecurity Act diventa qualcosa di più di una legge. È un atto di sovranità, un segnale politico, una dichiarazione di intenti. E, come ogni dichiarazione di questo tipo, genera una reazione. La Cina lo ha già fatto capire, con chiarezza: se l’Europa chiude, Pechino è pronta a rispondere. Non necessariamente sullo stesso terreno, ma con strumenti analoghi, capaci di colpire le catene di approvvigionamento globali e ridefinire gli equilibri commerciali. La guerra invisibile, dunque, non solo è diventata visibile ma ha cambiato forma. Non passa più soltanto dai data center o dagli attacchi informatici, ma dalle norme che stabiliscono chi può costruire, gestire e controllare le infrastrutture del mondo digitale. E in quella guerra, oggi, la legge è l’arma più sofisticata.

cybersecitalia.itApr 27, 2026extracted

DoJ Disrupts 3 Million-Device IoT Botnets Behind Record 31.4 Tbps Global DDoS Attacks

The U.S. Department of Justice (DoJ) on Thursday announced the disruption of command-and-control (C2) infrastructure used by several Internet of Things (IoT) botnets like AISURU, Kimwolf, JackSkid, and Mossad as part of a court-authorized law enforcement operation. The effort also saw authorities from Canada and Germany targeting the operators behind these botnets, with a number of private sector firms, including Akamai, Amazon Web Services, Cloudflare, DigitalOcean, Google, Lumen, Nokia, Okta, Oracle, PayPal, SpyCloud, Synthient, Team Cymru, Unit 221B, and QiAnXin XLab assisting in the investigation efforts. "The four botnets launched distributed denial-of-service (DDoS) attacks targeting victims around the world," the DoJ said. "Some of these attacks measured approximately 30 Terabits per second, which were record-breaking attacks." In a report last month, Cloudflare attributed AISURU/Kimwolf to a massive 31.4 Tbps DDoS attack that occurred in November 2025 and lasted only 35 seconds. Towards the end of last year, the botnet was also responsible for a series of hyper-volumetric DDoS attacks that had an average size of 3 billion packets per second (Bpps), 4 Tbps, and 54 million requests per second (Mrps). Independent security journalist Brian Krebs also traced the administrator of Kimwolf to a 23-year-old Jacob Butler (aka Dort) from Ottawa, Canada. Butler told Krebs he has not used the Dort persona since 2021 and claimed someone is impersonating him after compromising his old account. Butler also said, "he mostly stays home and helps his mom around the house because he struggles with autism and social interaction." According to Krebs, the other prime suspect is a 15-year-old residing in Germany. No arrests have been announced. First documented by XLab in December 2025, Kimwolf has conscripted more than 2 million Android devices into its network, most of which are compromised, off-brand Android smart TVs and set-top boxes. It's an Android-focused version of another botnet known as AISURU, which is known to be active since at least August 2024. In all, the four botnets are estimated to have infected no less than 3 million devices worldwide, such as digital video recorders, web cameras, or Wi-Fi routers, of which hundreds of thousands are located in the U.S. Cloudflare described the maximum attack traffic of the combined AISURU and Kimwolf botnets as equivalent to "the combined populations of the U.K., Germany, and Spain all simultaneously typing a website address and then hitting 'enter' at the same second." "The Kimwolf and JackSkid botnets are accused of targeting and infecting devices which are traditionally 'firewalled' from the rest of the internet. The infected devices were enslaved by the botnet operators," the DoJ said. "The operators then used a 'cybercrime as a service' model to sell access to the infected devices to other cyber criminals." These infected devices were then used to conduct DDoS attacks against targets of interest across the world. Court documents allege that the four Mirai botnet variants have issued hundreds of thousands of DDoS attack commands - AISURU - >200,000 DDoS attack commands Kimwolf - >25,000 DDoS attack commands JackSkid - >90,000 DDoS attack commands Mossad - >1,000 DDoS attack commands "Kimwolf represented a fundamental shift in how botnets operate and scale. Unlike traditional botnets that scan the open internet for vulnerable devices, Kimwolf exploited a novel attack vector: residential proxy networks," Tom Scholl, VP/Distinguished Engineer at AWS, said in a post shared on LinkedIn. "By infiltrating home networks through compromised devices — including streaming TV boxes and other IoT devices — the botnet gained access to local networks that are typically protected from external threats by home routers." Lumen Black Lotus Labs, in a statement shared with The Hacker News, said it has null-routed nearly 1,000 of the C2 servers used by AISURU and then Kimwolf. According to data gathered by the cybersecurity company, JackSkid averaged over 150,000 daily victims in the first two weeks of March 2026, hitting 250,000 on March 8. Mossad averaged over 100,000 daily victims during the same period. "The problem is, there are just so many devices out there that are vulnerable that two things happened – first, Kimwolf proved to be incredibly resilient," Ryan English, security researcher at Lumen's Black Lotus Labs, said. "The second problem was that multiple new botnets started to emulate the technique of using the vulnerability to grow very large, very fast." Black Lotus Labs also confirmed that the vulnerability – which affected proxy providers like IPIDEA and granted threat actors access to local network devices with Android Debug Bridge (ADB) exposed – has been exploited by JackSkid and Mossad as well to achieve the same goals as Kimwolf. This allowed them to leverage the residential proxy networks and "sweep up those bots for their own use." XLab told the publication that it provided sample hashes, decrypted C2 configurations, and screenshots of DDoS attacks as evidence. Akamai said the hyper-volumetric botnets generated attacks exceeding 30 Tbps, 14 billion packets per second, and 300 Mrps, adding that cybercriminals leveraged these botnets to launch hundreds of thousands of attacks and demand extortion payments from victims in some cases. "These attacks can cripple core internet infrastructure, cause significant service degradation for ISPs and their downstream customers, and even overwhelm high-capacity cloud-based mitigation services," the web infrastructure company said.

thehackernews.comMar 20, 2026extracted

Western governments lay the groundwork for secure 6G networks

Western governments lay the groundwork for secure 6G networks Governments are preparing for 6G, the next generation of mobile networks, placing security and resilience among their top priorities. In response, seven countries participating in the Global Coalition on Telecoms (GCOT) have introduced a set of 6G Security and Resilience Principles, developed with support from industry partners. The coalition brings together the governments of the United Kingdom, the United States, Canada, Japan, and Australia. Sweden and Finland recently joined as new members. Industry partners supporting the initiative include companies such as Ericsson, Nokia, Samsung, Qualcomm, NEC, AT&T, Vodafone, and NVIDIA. The Principles outline what GCOT governments expect from industry on the security and resilience of next-generation networks. They call for 6G systems protected from cyber and physical threats, supported by resilient supply chains, and able to provide reliable service. A UK Government statement said that “the governments of the GCOT hope that these Principles will serve as a touchstone for future work to develop 6G standards and will inform industry’s 6G research and development. They build on existing GCOT publications, including those on AI and Open RAN certification.” The Principles set out objectives for 6G development and may evolve as technologies and markets develop. “Although the commercial launch of 6G networks is still several years away, it is important to establish early the principles that will guide its development and support its success. The principles have been informed by industry input, and we are pleased to have been part of this process,” said Rob Joyce, Director of Mobile Access Engineering at Virgin Media O2.

helpnetsecurity.comMar 6, 2026extracted

Coalition of Western Countries Launches 6G Cybersecurity Guidelines

A coalition of seven governments has launched a set of voluntary cybersecurity and cyber resilience principles for 6G, the next generation of mobile networks. The Global Coalition on Telecoms (GCOT) was established in October 2023 to set out a shared commitment to support secure, resilient and innovative telecommunication networks. Founded by Australia, Canada, Japan, the UK and the US, the group was joined by Finland and Sweden during Mobile World Congress 2026. At the event in Barcelona, GCOT also launched the 6G Security and Resilience Principles with the support of leading industry partners, including AT&T, BT, Ericsson, NVIDIA, Nokia, Qualcomm, Rakuten Mobile, Samsung Electronics and Virgin Media O2 and Vodafone. While 6G standardization works are still in their infancy, with key industry groups targeting initial commercial rollouts in 2029-2030, GCOT believe broad predictions can be made based on the IMT-2030 Framework and initial 3GPP 6G studies. For instance, the coalition assessed that 6G will mean that more network functions will be virtualized, that disaggregated architectures and standardized interfaces will enable better visibility for security and better multi-vendor integration and that AI will be supported natively both to improve network performance and enable new user services. GCOT has developed four security principles and four resilience principles based on these predictions in order to help build 6G standards, covering resilience to cyber and physical attacks, supply chains, and reliability. The guidelines are also intended as a guide for all relevant stakeholders, according to a statement published by the UK government on March 3. Rob Joyce, director of mobile access engineering at Virgin Media O2, commented: “Although the commercial launch of 6G networks is some years away, it is helpful to establish at an early stage the principles that will guide the development of 6G and ensure its success.” GCOT’s Security and Resilience Objectives for 6G Networks The GCOT 6G guidelines aim to point to some of the critical security and resilience considerations that the coalition member states and industry partners recommend prioritizing in the ongoing development of the 6G system. These include: Containment: the 6G system should limit the ability of malicious actors or software to propagate through the network Confidentiality: the 6G system should be built by design to protect the privacy of user data and able to process and provide data confidentially (e.g. it is secure against eavesdropping or attackers, even for data shared over channels which are not physically secure or known) Integrity: the 6G system should maintain the integrity of data providing guarantees that any changes to data, as it travels through the network, are perceptible, as well as assure the integrity of network infrastructure itself Resilience: the 6G system should be measurably resilient and able to maintain service availability for users even in challenging circumstance, in particular for requirements like emergency or first-responder voice and data services, which must be future proofed in the transition to 6G Regulatory compliance: the operators of 6G systems should be able to fulfil the requirements of relevant national regulations and legislation GCOT further emphasized that future 6G infrastructure should incorporate robust failover mechanisms to ensure uninterrupted connectivity during disruptions. It also highlighted the importance of integrating complementary and alternative positioning, navigation and timing (PNT) solutions beyond GNSS to minimize vulnerability to signal loss or interference. Finally, GCOT advocated for the adoption of Open RAN frameworks and guiding principles to support flexibility, interoperability, and innovation within the network ecosystem. “The technological innovation anticipated from 6G, twinned with its central role in national infrastructure (as with current mobile networks), will require fundamental protections and mitigations to be considered from the outset,” reads the GCOT announcement shared by the UK government. “That will require action on the part of governments, telecommunications providers and those supplying the systems they rely on, including cloud and data infrastructure. It will also mean close working with domestic and regional regulatory bodies and through public-private partnerships, where appropriate, to ensure common understanding of threats and robust compliance.” Ronnie Vasishta, senior VP of telecom at NVIDIA, welcomed the initiative and said his company is “building the AI-RAN platforms that translate these guiding principles into operational reality in software-defined, AI-native 6G networks.” Eva Fogelström, head of security research at Ericsson, said: “We look forward to working with all partners involved in GCOT to ensure the next phase of advanced connectivity is not only high-performing and resilient, but also inclusive, sustainable, and future-ready.”

infosecurity-magazine.comMar 4, 2026extracted

Google fixes Android vulnerabilities “under targeted exploitation” (CVE-2025-48633, CVE-2025-48572)

Google fixes Android vulnerabilities “under targeted exploitation” (CVE-2025-48633, CVE-2025-48572) Google has shipped patches for 51 Android vulnerabilities, including two high-severity flaws (CVE-2025-48633, CVE-2025-48572) that “may be under limited, targeted exploitation”. According to the December Android security bulletin, both vulnerabilities affect the Android Framework, which is a collection of core software components, libraries, and APIs that developers use to build Android apps. Their exact nature has yet to be revealed, but the bulletin notes that CVE-2025-48633 can be exploited by Android applications to access sensitive information, and CVE-2025-48572 may allow attackers to elevate privileges on vulnerable Android devices. As per usual, details about the attacks are kept under wraps, but the wording seems to point to state-sponsored attackers and/or espionage via spyware. The bulletin lists additional 56 flaws affecting Android’s kernel, and ARM, Imagination Technologies, MediaTek, Unisoc and Qualcomm components. Patches for those will be included in the December 5 “patch level” (2025-12-05). (Google ships two security patch levels “so that Android partners have the flexibility to fix a subset of vulnerabilities that are similar across all Android devices more quickly.”) The December 1 patches (2025-12-01) are available for Android 13, 14, 15, and 16. Security updates for Android-based devices Vendors of Android-powered devices usually get a month or so to develop security updates, so they may ship them around the same time Google publishes its monthly Android security bulletin. Samsung has pushed out a maintenance release for major flagship models that includes patches from both Google and Samsung, including the one for CVE-2025-48633. Motorola has likewise patched only CVE-2025-48633 this December. Huawei, LGE, Nokia, Oppo, and others are expected to release patches soon. Android users are advised to check for updates and implement them if they are available. UPDATE (December 3, 2025, 09:30 a.m. ET): CISA has added the two vulnerabilities to its Known Exploited Vulnerabilities catalog. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

helpnetsecurity.comDec 2, 2025extracted

Cultura aziendale e cyber security: la lezione di Nokia per i CISO del futuro

Parlando di cultura aziendale e cyber security, la storia recente di Nokia rappresenta un’utile lezione per i CISO del futuro. «Non abbiamo fatto nulla di sbagliato, ma in qualche modo abbiamo perso»: con queste parole l’AD di Nokia nel 2016 sintetizzava il fallimento di un colosso che esisteva dal 1865. Un’organizzazione economicamente solida, avversa al rischio, che non commetteva errori dal proprio punto di vista ma fece l’errore fatale: diede per scontata la propria rilevanza senza elaborare una strategia alternativa. È appunto una lezione per i CISO moderni che devono influenzare la cultura organizzativa per ottenere il consensus del top management. La cultura influenza la percezione del programma di sicurezza a tutti i livelli e spesso riflette la personalità del CISO stesso. La sfida è integrare abitudini e convinzioni di sicurezza attraverso flessibilità culturale, documentazione formale e comunicazione efficace. Ecco, dunque, una semplice guida pratica per fornire ai professionisti gli strumenti per leggere, comprendere e influenzare la cultura organizzativa, trasformando la sicurezza da obbligo tecnico a valore culturale condiviso[1]. Indice degli argomenti Nokia esisteva dal 1865 ed era una delle più grandi aziende del mondo nel 2016. Economicamente solida, avversa al rischio, dal proprio punto di vista non commetteva errori. Ma diede per scontata la propria rilevanza e non sentì il bisogno di elaborare una visione strategica. Non si assunse alcun rischio imprenditoriale, non diversificò il proprio business e nel 2016 fu venduta: una lezione drammatica di come la percezione interna possa divergere completamente dalla realtà di mercato, portando al collasso anche giganti apparentemente invincibili. L’immagine dell’AD e del suo team che piangono pubblicamente dopo aver dichiarato di non aver fatto nulla di sbagliato rappresenta l’epitome della disconnessione tra leadership e realtà. Dichiarare di non aver fatto nulla di sbagliato, di fronte a un risultato così fallimentare, significa non aver preso coscienza del proprio errore né prima, né dopo. E chi non elabora la propria storia, la dimentica o la minimizza, è destinato a ripeterla. Si tratta di un monito per ogni organizzazione che si considera al sicuro semplicemente perché segue le regole interne. La cultura di un’organizzazione influenza direttamente la percezione del programma di sicurezza da parte dei dipendenti a tutti i livelli. Il programma spesso riflette la personalità del CISO, creando un circolo vizioso o virtuoso che può determinare successo o fallimento delle iniziative di sicurezza. Il CISO deve comprendere quale sia la cultura della propria organizzazione prima di tentare qualsiasi influenza, per evitare di replicare l’errore Nokia su scala diversa. In particolare, la costruzione di una corretta cultura aziendale della cyber security si fonda su quattro pilastri: Enfatizzare obiettivi e risultati attesi. Per influenzare la cultura agli occhi dei membri senior che dovranno fornire il consensus, il primo passo è enfatizzare gli obiettivi e gli esatti risultati attesi. Chiarezza e misurabilità diventano fondamentali per ottenere supporto dal top management. Ricompensare comportamenti allineati. Ricompensare i comportamenti in linea con obiettivi e risultati attesi rinforza positivamente la trasformazione culturale. Il sistema di incentivi deve supportare concretamente i cambiamenti desiderati invece di ostacolarli. Dare l’esempio. Se vuoi vedere più lavoro di squadra, partecipa più spesso al lavoro di squadra. La leadership by example rimane lo strumento più potente per influenzare la cultura organizzativa, specialmente in ambiti percettivi come la sicurezza. Gestire comportamenti non allineati. Punire o mettere in imbarazzo le persone non funziona. I comportamenti da correggere vanno scoraggiati fornendo inizialmente feedback in meeting vis a vis. Se ci sono reiterazioni, il richiamo verbale può diventare scritto e, per recidivi cronici, rimane solo la strada del licenziamento. Terminata la costruzione di una cultura aziendale della cyber security è poi utile individuare e applicare i tre principali principi di integrazione culturale. Flessibilità alla cultura aziendale. Il primo principio richiede adattamento della strategia di sicurezza alla cultura esistente, invece di tentare di imporre modelli esterni incompatibili. La flessibilità culturale permette di innestare cambiamenti sostenibili. Documentazione formale. Policy, standard e procedure devono essere formalizzati per creare riferimenti chiari e misurabili. La documentazione trasforma principi culturali in regole operative concrete e verificabili. Comunicazione e formazione. Creare consapevolezza dell’esistenza delle nuove policy attraverso comunicazione efficace, accompagnata dalla formazione necessaria per comprenderle e dipanare dubbi. Senza comunicazione, anche le migliori policy rimangono lettera morta. Test di fiducia reciproca. Hai una fiducia tale nei tuoi colleghi a tutti i livelli da scommetterci il tuo stipendio? La fiducia reciproca tra organizzazione e dipendenti rappresenta un elemento basilare per il successo e la costruzione di un ambiente lavorativo sano. Job rotation strategica. In azienda è presente la job rotation dei dirigenti? Questa pratica sviluppa leadership più completa, garantisce esperienza in diverse aree e può smascherare comportamenti opachi che il successore può mettere in luce rispetto al predecessore. Silos organizzativi. Gli uffici sono cittadelle fortificate ognuna con il proprio feudatario, ciambellani e soldati? La presenza di silos può ostacolare comunicazione e collaborazione, creando strascichi tra persone e dipartimenti. Ostacoli alla collaborazione. Come avete rimosso gli ostacoli per la collaborazione tra uffici? La rimozione può essere raggiunta attraverso policy di comunicazione chiare, promozione di cultura collaborativa, formazione dipendenti e strumenti di collaborazione online. Analisi comportamentale. I dati mostrano pattern di comportamenti dei clienti che ti aiutano a interagire meglio? L’analisi dei dati comportamentali – anche per clienti interni come Board o uffici – rivela modelli, preferenze ed esigenze per adattare strategie e migliorare l’esperienza. Sessioni informali e ludiche tra membri di team diversi risultano più efficaci di 100 sessioni in aula: una partita a calcio, la raccolta differenziata nei boschi, uno spettacolo teatrale con disabili creano legami autentici che superano barriere organizzative. In un team building misto, definire obiettivi comuni condivisi che richiedano collaborazione interdisciplinare rompe naturalmente i silos e crea necessità di comunicazione tra dipartimenti precedentemente isolati. Affrontare l’avversione al rischio richiede educazione su conseguenze di cattiva gestione e sviluppo di policy equilibrate che riducano rischi senza compromettere efficienza operativa. La valutazione e gestione dei rischi devono diventare parte integrante della cultura per decisioni informate, non avventate né inerti. Solo affrontando queste sfide interne l’organizzazione può migliorare significativamente la propria postura di sicurezza e ridurre il rischio di replicare il destino Nokia: essere tecnicamente corretti, ma strategicamente irrilevanti. [1] Per approfondire le tecniche di analisi e trasformazione culturale, metodologie per ottenere consensus dal top management e strumenti per integrare la sicurezza nella cultura aziendale, il Manuale CISO Security Manager dedica ampio spazio alle dinamiche organizzative e alla leadership trasformazionale.

cybersecurity360.itDec 2, 2025extracted

Nvidia investe 1 miliardo di dollari in Nokia per lo sviluppo delle reti 6G con AI

Betti RHC, la prima graphic novel al mondo dedicata alla cybersecurity awareness, ha finalmente il suo sito ufficiale. Uno spazio tutto suo dove scoprire il progetto, sfogliare le copertine degli episodi e immergersi nel mondo di Betti: la giovane laureanda in informatica che, dopo la morte misteriosa del padre, si trasforma nell'hacker più potente del mondo. Una storia avvincente che, episodio dopo episodio, affronta una minaccia digitale diversa — dal phishing al ransomware, fino al cyberbullismo — e insegna a riconoscerla e a difendersi, senza che sembri mai una lezione. Sul sito trovate tutto ciò che rende Betti un progetto diverso dal solito: la sua filosofia, le anteprime delle tavole e il racconto di come nasce ogni volume. Perché dietro Betti RHC c'è solo lavoro umano: ogni tavola è disegnata interamente a mano dagli artisti del Gruppo Arte di Red Hot Cyber, senza alcun uso di intelligenza artificiale. E a garantire che ogni storia sia realistica e tecnicamente corretta c'è la supervisione degli hacker etici del gruppo HackerHood, che mantengono il racconto fedele al mondo reale della sicurezza informatica. C'è spazio anche per le aziende, che possono usare Betti come strumento di awareness diverso dai soliti corsi: acquistare i volumi, personalizzarli con il proprio brand o sponsorizzare nuovi episodi. E come primo regalo, l'episodio "Byte the Silence", dedicato al cyberbullismo, è scaricabile gratuitamente per uso personale. Perché la miglior difesa, in fondo, è una bella storia. 👉 Scopri tutto su https://betti.redhotcyber.com/

redhotcyber.comOct 31, 2025extracted

In Other News: 600k Hit by Healthcare Breaches, Major ShinyHunters Hacks, DeepSeek’s Coding Bias

SecurityWeek’s cybersecurity news roundup provides a concise compilation of noteworthy stories that might have slipped under the radar. We provide a valuable summary of stories that may not warrant an entire article, but are nonetheless important for a comprehensive understanding of the cybersecurity landscape. Each week, we curate and present a collection of noteworthy developments, ranging from the latest vulnerability discoveries and emerging attack techniques to significant policy changes and industry reports. Here are this week’s stories: ShinyHunters stole data of Gucci, Balenciaga and Alexander McQueen customers The ShinyHunters group may have stolen the information of millions of customers of luxury brands Gucci, Balenciaga and Alexander McQueen, BBC reported. Parent company Kering has confirmed suffering a data breach, but said no financial information was compromised. The hackers claimed to have stolen data associated with 7.4 million unique email addresses. Goshen Medical Center data breach impacts 450,000 Goshen Medical Center, a healthcare organization in North Carolina, has disclosed a data breach impacting more than 450,000 people. The company has confirmed that hackers stole personal and health information months after the BianLian ransomware group listed the organization on its leak website. It’s unclear what happened to the stolen data as the BianLian group has not been active since March. Retina Group of Florida data breach Another significant healthcare data breach was reported by ophthalmology practice Retina Group of Florida. The organization detected an intrusion in November 2024 and its investigation showed that the information of over 150,000 people may have been compromised as a result of the incident. Critical Chaos-Mesh vulnerabilities JFrog discovered four vulnerabilities in the Chaos engineering platform Chaos-Mesh, including three critical-severity flaws that could be exploited for code execution on any pod in the cluster. Named Chaotic Deputy, the security defects are tracked as CVE-2025-59358, CVE-2025-59360, CVE-2025-59361 and CVE-2025-59359 and were addressed in Chaos-Mesh version 2.7.3. ShinyHunters claims theft of 1.5 billion records in Salesforce hack The cybercrime group ShinyHunters claims to have stolen 1.5 billion records from 760 companies in the recent Salesforce–Salesloft attack, Bleeping Computer reported. Many cybersecurity firms have confirmed being impacted, but the claims of these types of hacking groups have often been exaggerated. DeepSeek AI generates less secure code for China dissident groups Research conducted by CrowdStrike shows that the code generated by the AI of Chinese firm DeepSeek is less secure if the request specifies that the code is for dissidents or other groups that may be considered sensitive by the Chinese government. If the request to DeepSeek specifies that the code is for the banned spiritual movement Falun Gong or the Islamic State, the AI may refuse to generate code. If it doesn’t refuse, the code is more likely to contain vulnerabilities, and so is in the case of code generated for Tibet and Taiwan. Code for industrial control systems is the most likely to contain security flaws. Claroty publishes Global State of CPS Security report Claroty has published a report titled ‘Global State of CPS Security 2025: Navigating Risk in an Uncertain Economic Landscape’. Based on a survey of 1,100 cybersecurity professionals, the report shows that 49% believe shifting global economic policies and geopolitical tensions are driving increased risk across cyber-physical system (CPS) assets and processes. More than three-quarters believe emerging regulations will force them to overhaul their current CPS security strategies. Atlassian, Mozilla, WatchGuard, Nokia patches Atlassian released patches for four vulnerabilities in third-party components used in Confluence, Jira, and Jira Service Management Data Center and Server. Mozilla rolled out Thunderbird and Firefox updates that resolve roughly a dozen bugs. WatchGuard announced fixes for CVE-2025-9242, a critical-severity flaw in Fireware OS that could lead to remote code execution, without authentication. Nokia informed customers about Nokia Container Service (NCS) and CloudBand Infrastructure Software (CBIS) flaws allowing authentication bypass and remote code execution. Eve Security raises $3 million in seed funding Austin, Texas-based Eve Security announced that it has raised $3 million in a seed funding round from LiveOak Ventures and Tau Ventures. The company also announced the launch of its product, EveGuard, an agentic AI observability and policy enforcement platform. The platform leverages Agent-in-the-Loop (AITL) technology to ensure the security of AI agents interacting with a company’s critical business systems.

securityweek.comSep 19, 2025extracted

From Quantum Hacks to AI Defenses – Expert Guide to Building Unbreakable Cyber Resilience

Quantum computing and AI working together will bring incredible opportunities. Together, the technologies will help us extend innovation further and faster than ever before. But, imagine the flip side, waking up to news that hackers have used a quantum computer to crack your company's encryption overnight, exposing your most sensitive data, rendering much of it untrustworthy. And with your sensitive data exposed, where does that leave trust from your customers? And the cost to mitigate - if that is even possible with your outdated pre-quantum systems? According to IBM, cyber breaches are already hitting businesses with an average of $4.44 million per incident, and as high as $10.22 million in the US, but with quantum and AI working simultaneously, experts warn it could go much higher. In 2025, nearly two-thirds of organizations see quantum computing as the biggest cybersecurity threat looming in the next 3-5 years, while 93% of security leaders are prepping for daily AI-driven attacks. If you're in tech, finance, healthcare, or any field handling big data, this isn't sci-fi—it's the storm brewing right now. But what if you could get ahead of it? Build reliable systems with multiple layers of protection that keep your operations rock-solid? That's what our upcoming webinar, "Building Trust and Resilience for the AI and Quantum 2.0 Era," is all about. It's a panel of top experts diving into the world where quantum meets AI, and how to make your infrastructure unbreakable. Happening soon—don't miss out. Sign up for the Webinar now and secure your spot today! The Risk Hiding in Quantum and AI Advances Let's keep it real: Quantum 2.0 is exploding with cool stuff like super-fast computing, entanglement for instant communication, and sensors that see the unseen. Throw AI into the mix, and it's optimizing and analyzing everything from quantum systems to drug discovery to evolving everyday tech. Sounds awesome, right? But here's the flip side—these technology breakthroughs are also widening the door for cyber bad guys. Quantum computers could render much of today’s encryption useless, while AI makes attacks smarter and faster. Experts warn that AI-powered attacks are already growing in sophistication, and many security leaders believe quantum computing will dramatically increase future risks. I've heard from pros in the field sharing nightmare stories: AI-driven phishing fools 60% of folks, just like old-school tricks, but now it's GenAI making fakes that look too real. And quantum? It's not decades away—threats like "harvest now, decrypt later" mean attackers are grabbing encrypted data today, waiting for quantum tech to unlock it. Without the right defenses, sectors like finance and healthcare could face chaos, losing data integrity and facing massive fines. The good news? Solutions are available now that can protect you for Q-day and today. What You'll Walk Away With: Simple Steps to Build Resilience In this lively 60-minute panel, you'll hear from rockstar experts who've been shaping this space. They'll break down the hype and hand you practical ways to protect your world. No jargon overload—just straight talk on breakthroughs and how to turn them into your advantage. Here's a taste of what they'll cover: The Buzz on Quantum 2.0: Get the lowdown on how quantum computing, sensing, and comms are changing the game—and how AI supercharges it all for smarter systems. Why AI and Quantum Need to Play Nice with Security: Learn why crypto-resilient setups are a must, with tips on aligning innovations without leaving weak spots. Tackling Risks in This New World: Dive into managing threats in AI-quantum mashups, including how to spot and stop emerging dangers before they hit. Tailored Fixes for Your Industry: Whether you're in finance, healthcare, or critical infra, grab strategies customized for high-stakes data protection. Your Roadmap from Start to Finish: Walk through planning, consulting, rollout, and ongoing services to make resilience a reality. What Leaders Need to Do Right Now: Key moves for bosses to lock in long-term security and keep things running smoothly. Meet the Experts Dr. Michael Eggleston, Data & Devices Group Leader, Nokia Bell Labs: Leading advances in quantum tech and sensing. Dr. Michele Mosca, Co-founder, evolutionQ & Programme Chair of the ETSI-IQC Quantum-Safe Cryptography Conference: Pioneer in quantum-safe crypto. Donna Dodson, Former Chief Cybersecurity Advisor, NIST: Innovator in government cybersecurity. Bill Genovese, CIO Advisory Partner, Global Quantum Services & Consulting Leader, Kyndryl: Strategist in emerging tech like quantum and AI. Martin Charbonneau, Head of Quantum-Safe Networks, Nokia: Expert in securing networks against quantum threats. Ready to arm yourself with these insights? Sign up for the Webinar now and join the conversation. With quantum threats ramping up, adversaries using AI for slicker attacks—and reports like the Global Cybersecurity Outlook warning that 47% of orgs fear GenAI-boosted bad guys, waiting it out isn't an option. Cyber resilience and agility isn't just nice-to-have; it's urgent, as quantum tech could reshape cryptography and pose risks sooner than we think. This webinar isn't fluff—it's your shield for the AI-quantum era, blending innovation with rock-hard resilience. Seats fill up fast, it's a quick win for huge peace of mind. Save your seat now – See you there!

thehackernews.comSep 17, 2025extracted

Nokia successor HMD spawns secure device biz with Euro-made smartphone

SAAS Salesforce partners are not seeing revenue from Agentforce AI platform, report saysTwo years after launch, Agentforce not boosting the ecosystem as much as expected, or so say partners ai and ml AI companies are burning books, advocates complain to FTCFahrenheit 203, the temperature GPUs stop gorging on literature DEVOPS Go updates may delight diehard gophers but displease AI overlordsv 1.27 expands generics to support methods EDGE AND IOT Waymo has designed a robocar chip to stay ahead of Tesla5 nm ML accelerators promise 1,000+ TOPS, ultra-low latency SYSTEMS AMD inches closer to its goal of making AI suck less ... energyHouse of Zen claims latest systems already 4x more efficient than two years ago Security Russians are posing as Signal support to launch phishing attacksPLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more! Security Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attackPLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more Black Hat and DEF CON DEF CON Franklin project enlists hackers to harden critical infrastructureVoting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included Security EQT buys majority share in Swiss cybersecurity biz AcronisWent at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified Malware Month Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sightOn the plus side, infosec's a good bet for a long, stable career FOSS smashed one Microsoft monopoly. After 20 years of failure, it's time to smash anotherWord up GNOME can look like Windows – and Flashback can do it without extensionsNew 'Simple-taskbar' is an option, but there's a simpler, stabler way A moment of silence, please, for the final release of Debian on x86-32New Debian versions hit FOSSland in the form of 13.6 and 12.15 Baddies caught exploiting extensions bugs with perfect 10 scores on vulnerable Joomla websitesFlaws in iCagenda, Balbooa Forms extensions can impact open source CMS that powers a million sites worldwide Frame: A new X11 server – implemented directly in assemblyJoins yserver, Phoenix, and of course XLibre – and outlier Arcan Cinnamon 6.8 will support Wayland – if you want itNext version of Linux Mint’s desktop has both kinds of display server

go.theregister.comSep 9, 2025extracted

SaaS giant Workiva discloses data breach after Salesforce attack

Update September 04, 06:27 EDT: Updated the list of cybersecurity companies whose Salesloft supply chain attack. Workiva, a leading cloud-based SaaS (Software as a Service) provider, notified its customers that attackers who gained access to a third-party customer relationship management (CRM) system stole some of their data. The company's cloud software helps collect, connect, and share data for financial reports, compliance, and audits. It had 6,305 customers at the end of last year and reported revenues of $739 million in 2024. Its customer list includes 85% of the Fortune 500 companies and high-profile clients such as Google, T-Mobile, Delta Air Lines, Wayfair, Hershey, Slack, Cognizant, Santander, Nokia, Kraft Heinz, Wendy's, Paramount, Air France KLM, Mercedes-Benz, and more. According to a private email notification sent to affected Workiva customers last week and seen by BleepingComputer, the threat actors exfiltrated a limited set of business contact information, including names, email addresses, phone numbers, and support ticket content. "This is similar to recent events that have targeted several large organizations. Importantly, the Workiva platform and any data within it were not accessed or compromised," the company explained. "Our CRM vendor notified us of unauthorized access via a connected third-party application." Workiva also warned impacted customers to remain vigilant, as the stolen information could be used in spear-phishing attacks. "Workiva will never contact anyone by text or phone to request a password or any other secure details. All communications from Workiva come through our trusted official support channels," it said. Salesforce data breaches While Workiva didn't share more details regarding this attack, BleepingComputer has learned that this incident was part of the recent wave of Salesforce data breaches linked to the ShinyHunters extortion group that impacted many high-profile companies. Most recently, Cloudflare disclosed that it was forced to rotate 104 Cloudflare platform-issued tokens stolen by ShinyHunters threat actors, who gained access to the Salesforce instance used for customer support and internal customer case management in mid-August. ShinyHunters has been targeting Salesforce customers in data theft attacks using voice phishing (vishing) since the start of the year, impacting companies such as Google, Cisco, Allianz Life, Farmers Insurance, Workday, Qantas, Adidas, and LVMH subsidiaries, including Dior, Louis Vuitton, and Tiffany & Co. More recently, the extortion group has shifted to using stolen OAuth tokens for Salesloft's Drift AI chat integration with Salesforce to gain access to customer Salesforce instances and extract sensitive information, such as passwords, AWS access keys, and Snowflake tokens, from customer messages and support tickets. CyberArk, Elastic, Nutanix, Qualys, Cato Networks, Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

bleepingcomputer.comSep 3, 2025extracted

Salt Typhoon Exploits Cisco, Ivanti, Palo Alto Flaws to Breach 600 Organizations Worldwide

The China-linked advanced persistent threat (APT) actor known as Salt Typhoon has continued its attacks targeting networks across the world, including organizations in the telecommunications, government, transportation, lodging, and military infrastructure sectors. "While these actors focus on large backbone routers of major telecommunications providers, as well as provider edge (PE) and customer edge (CE) routers, they also leverage compromised devices and trusted connections to pivot into other networks," according to a joint cybersecurity advisory published Wednesday. "These actors often modify routers to maintain persistent, long-term access to networks." The bulletin, courtesy of authorities from 13 countries, said the malicious activity has been linked to three Chinese entities, Sichuan Juxinhe Network Technology Co., Ltd., Beijing Huanyu Tianqiong Information Technology Co., Ltd., and Sichuan Zhixin Ruijie Network Technology Co., Ltd. These companies, the agencies said, provide cyber-related products and services to China's intelligence services, with the data stolen from the intrusions, specifically those against telecoms and Internet service providers (ISPs), providing Beijing with the ability to identify and track their targets' communications and movements globally. The countries that have co-sealed the security advisory include Australia, Canada, the Czech Republic, Finland, Germany, Italy, Japan, the Netherlands, New Zealand, Poland, Spain, the U.K., and the U.S. Brett Leatherman, head of the U.S. Federal Bureau of Investigation's Cyber Division, said the Salt Typhoon group has been active since at least 2019, engaging in a persistent espionage campaign aimed at "breaching global telecommunications privacy and security norms." In a standalone alert issued today, Dutch intelligence and security services MIVD and AIVD said while organizations in the country "did not receive the same degree of attention from the Salt Typhoon hackers as those in the U.S.," the threat actors gained access to routers of smaller ISPs and hosting providers. However, there is no evidence the hackers penetrated these networks further. "Since at least 2021, this activity has targeted organisations in critical sectors including government, telecommunications, transportation, lodging, and military infrastructure globally, with a cluster of activity observed in the U.K.," the National Cyber Security Centre said. According to The Wall Street Journal and The Washington Post, the hacking crew has expanded its targeting focus to other sectors and regions, attacking no less than 600 organizations, including 200 in the U.S., and 80 countries. Salt Typhoon, which overlaps with activity tracked as GhostEmperor, Operator Panda, RedMike, and UNC5807, has been observed obtaining initial access through the exploitation of exposed network edge devices from Cisco (CVE-2018-0171, CVE-2023-20198, and CVE-2023-20273), Ivanti (CVE-2023-46805 and CVE-2024-21887), and Palo Alto Networks (CVE-2024-3400). However, the agencies pointed out these vulnerabilities are not "exhaustive" and that the threat actors may also go after other devices such as Fortinet firewalls, Juniper firewalls, Microsoft Exchange, Nokia routers and switches, Sierra Wireless devices, and Sonicwall firewalls, among others for initial access. "The APT actors may target edge devices regardless of who owns a particular device," the agencies noted. "Devices owned by entities that do not align with the actors’ core targets of interest still present opportunities for use in attack pathways into targets of interest." The compromised devices are then leveraged to pivot into other networks, in some cases even modifying the device's configuration and adding a generic routing encapsulation (GRE) tunnel for persistent access and data exfiltration. Persistent access to target networks is accomplished by altering Access Control Lists (ACLs) to add IP addresses under their control, opening standard and non-standard ports, and running commands in an on-box Linux container on supported Cisco networking devices to stage tools, process data locally, and move laterally within the environment. Also put to use by the attackers are authentication protocols like Terminal Access Controller Access Control System Plus (TACACS+) to enable lateral movement across network devices, while simultaneously conducting extensive discovery actions and capturing network traffic containing credentials via compromised routers to burrow deeper into the networks. "The APT actors collected PCAPs using native tooling on the compromised system, with the primary objective likely being to capture TACACS+ traffic over TCP port 49," the agencies said. "TACACS+ traffic is used for authentication, often for administration of network equipment and including highly privileged network administrators' accounts and credentials, likely enabling the actors to compromise additional accounts and perform lateral movement." On top of that, Salt Typhoon has been observed enabling the sshd_operns service on Cisco IOS XR devices to create a local user and grant it sudo privileges to obtain root on the host OS after logging in via TCP/57722. Google-owned Mandiant, which was one of the many industry partners that contributed to the advisory, stated the threat actor's familiarity with telecommunications systems offers them a unique advantage, giving them an upper hand when it comes to defense evasion. It's worth pointing out that UNC5807 is a threat cluster that's distinct from UNC2286, which, in the past, has been identified as overlapping with FamousSparrow and GhostEmperor, according to Google Threat Intelligence Group (GTIG) and Mandiant. "While some public reporting has associated both UNC5807 and UNC2286 with the 'GhostEmperor' alias, Google assesses these to be distinct threat clusters," Dan Perez, China Mission Lead at GTIG, told The Hacker News. "Our analysis is based on distinctions in their operational tradecraft and motivations." "The toolsets used by each group are different. UNC5807 has been observed using a specific and limited set of malware families. In contrast, UNC2286 employs a much broader and more varied arsenal of malicious tools. Additionally their objectives are different. We have observed UNC2286 conducting financially motivated attacks, including ransomware deployment and extortion. The activities attributed to UNC5807, however, are consistent with espionage operations." "An ecosystem of contractors, academics, and other facilitators is at the heart of Chinese cyber espionage," John Hultquist, Chief Analyst at GTIG, told the publication. Contractors are used to build tools and valuable exploits as well as carry out the dirty work of intrusion operations. They have been instrumental in the rapid evolution of these operations and growing them to an unprecedented scale." "In addition to targeting telecommunications, reported targeting of hospitality and transportation by this actor could be used to closely surveil individuals. Information from these sectors can be used to develop a full picture of who someone is talking to, where they are, and where they are going." (The story was updated after publication to make it clear that the threat actors are targeting and may target a broad range of edge network appliances.)

thehackernews.comAug 28, 2025extracted

Open-source flow monitoring with SENSOR: Benefits and trade-offs

Open-source flow monitoring with SENSOR: Benefits and trade-offs Flow monitoring tools are useful for tracking traffic patterns, planning capacity, and spotting threats. But many off-the-shelf solutions come with steep licensing costs and hardware demands, especially if you want to process every packet. A research team at the University of Tübingen has built an alternative: an open-source, cost-effective, and distributed platform for collecting unsampled IPFIX data. Their system, called SENSOR, uses open-source software and vendor-agnostic components to monitor traffic at multiple points in the university’s network. This setup captures internal flows that would otherwise go unnoticed if monitoring were only done at the perimeter. The approach avoids the need for expensive routers with built-in flow exporters and instead uses mirror ports and general-purpose servers running software-based flow meters. Flow monitoring platform at the University of Tübingen How it works At the core of the platform are two types of flow meters: high-performance servers running the open-source tool yaf, and MikroTik routers using a custom configuration to generate IPFIX from mirrored traffic. For backbone and datacenter traffic, the team uses servers with 100 Gbit/s NICs and yaf configured to use the PF RING library for packet processing. yaf supports plugins for deep packet inspection, application labeling, and even DHCP-based OS identification. For access-level monitoring, the team turned to MikroTik routers. These devices don’t normally support passive flow monitoring from mirror ports. But the researchers found a workaround. By creating a bridge and forcing traffic through RouterOS’s firewall stack, they were able to get MikroTik’s “traffic flow” feature to generate usable IPFIX data, even though the packets weren’t originally forwarded by the device. This lets them use a relatively low-cost router with a powerful CPU to collect flow data without modifying the rest of the network. Collecting and processing flows On the collection side, the platform uses several tools in parallel: nfacctd to replicate flows, nfdump and SiLK for analysis and storage, and GoFlow2 for format conversion. GoFlow2 standardizes flows into JSON or Protobuf and sends them to Apache Kafka, which lets downstream components process them as events. The team also uses flowpipeline to build analysis workflows, including anonymization and metrics extraction. By mixing and matching collectors, the system can support different use cases and allow for custom pipelines. Each component is replaceable and modular, which helps tailor the platform to performance needs or analysis goals. Why it matters Most flow monitoring setups rely on embedded flow meters that are locked to a vendor and require powerful, expensive devices. SENSOR shows it’s possible to build a flexible and scalable alternative using only open tools and commodity hardware. It also allows operators to monitor internal traffic more comprehensively, not just what crosses the network border. Boris Lukashev, CTO at Semper Victus & InferSight, told Help Net Security that the ability to collect unsampled flows with open tools is valuable, but context matters. “Sampling works well for network engineering but is less effective for security operations. Vendor approaches vary, and if someone exfiltrates a few bytes over a segment sampled at 100:1, you might miss it entirely. Some vendors still capture it even when ‘off-sample’ because it’s stored in the device’s internal flow tables.” Lukashev says the paper makes a fair point, but the pipeline the researchers built feels heavier than necessary unless you need advanced enrichment with deterministic latency. “Full line-rate NIDS taps are typically beyond the scope of most network engineering teams that support security, and they require architectural planning before purchase to be effective. Flow collection is much simpler as long as it starts at the actual packet processing point, whether that’s the dataplane, ring 0, or wherever the work happens,” Lukashev explained. The system is already deployed at the University of Tübingen, and the team plans to expand their work by benchmarking the performance limits of the flow meters and packet processing libraries involved. Understanding where those limits lie will help ensure that monitoring stays unsampled even at higher traffic volumes. Scaling beyond small networks David Montoya, Global Business Development Manager OT/IoT at Paessler, calls SENSOR “a great example of how to use open-source technologies to overcome a lack of enterprise-grade equipment while still granting access to in-depth traffic analysis.” But he also cautions that it is “based on technologies that are not the first choice for a large network or an ISP.” While MikroTik routers play a key role in SENSOR, David points out that these devices are aimed at small and medium-sized businesses rather than large enterprises. They fill routing gaps effectively and affordably, but he sees limited use for them at scale compared to equipment from Cisco, Juniper, Huawei, or Nokia. He notes that enterprise-class routers from the major vendors already ship with embedded IPFIX, NetFlow v9, or jFlow, along with the processing power to handle traffic sampling. These can connect directly to collectors and integrate with other monitoring protocols such as SNMP for volume tracking, RMON for data corruption detection, and QoS tools for measuring jitter and packet loss. Together, these provide a broader operational view. The limitation with SENSOR, he says, is that while it offers detailed flow visibility, it doesn’t unify these other protocols in one interface. For a large network, that can make troubleshooting and oversight more complex. “Something like this is fine for small networks,” David explains, “but it certainly complicates troubleshooting and oversight on larger networks.” David also sees potential for SENSOR to expand beyond historical analysis by adding real-time alerting. “The paper doesn’t describe whether the flow collectors can trigger alarms for anomalies like rapidly spiking UDP traffic, which could indicate a DDoS attack in progress. Adding real-time triggers like this would be a valuable enhancement that makes SENSOR more operationally useful for network teams.” Hardware and performance caveats Leo Valentić, CEO at RESILIX, highlights hardware-related constraints in SENSOR’s design. “The main limitation is that the MikroTik bridge workaround sends mirrored traffic through the CPU instead of dedicated switching hardware. This limits performance, makes the setup less robust, and creates a bottleneck in high-throughput environments that can lead to dropped packets or incomplete flow data, which undermines the goal of unsampled monitoring.” Valentić notes there is also a risk of drops or inconsistencies in flow exports, since the device is not designed to handle passive mirrored traffic this way and can behave unpredictably under load. “Finally, the approach is fragile. It relies on precise bridge and firewall configurations to push traffic through the RouterOS stack, which makes it sensitive to updates, misconfigurations, or hardware changes. In production environments where reliability is critical, this would be hard to justify,” he concluded. For now, SENSOR is best seen as a capable, budget-friendly option for historical analysis and targeted monitoring, with room to grow if real-time alerting and greater scalability are added. Must read: 35 open-source security tools to power your red team, SOC, and cloud security GitHub CISO on security strategy and collaborating with the open-source community Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!

helpnetsecurity.comAug 14, 2025extracted

Nokia sotto attacco: su DarkForums spunta in vendita il database di quasi 100.000 dipendenti

Betti RHC, la prima graphic novel al mondo dedicata alla cybersecurity awareness, ha finalmente il suo sito ufficiale. Uno spazio tutto suo dove scoprire il progetto, sfogliare le copertine degli episodi e immergersi nel mondo di Betti: la giovane laureanda in informatica che, dopo la morte misteriosa del padre, si trasforma nell'hacker più potente del mondo. Una storia avvincente che, episodio dopo episodio, affronta una minaccia digitale diversa — dal phishing al ransomware, fino al cyberbullismo — e insegna a riconoscerla e a difendersi, senza che sembri mai una lezione. Sul sito trovate tutto ciò che rende Betti un progetto diverso dal solito: la sua filosofia, le anteprime delle tavole e il racconto di come nasce ogni volume. Perché dietro Betti RHC c'è solo lavoro umano: ogni tavola è disegnata interamente a mano dagli artisti del Gruppo Arte di Red Hot Cyber, senza alcun uso di intelligenza artificiale. E a garantire che ogni storia sia realistica e tecnicamente corretta c'è la supervisione degli hacker etici del gruppo HackerHood, che mantengono il racconto fedele al mondo reale della sicurezza informatica. C'è spazio anche per le aziende, che possono usare Betti come strumento di awareness diverso dai soliti corsi: acquistare i volumi, personalizzarli con il proprio brand o sponsorizzare nuovi episodi. E come primo regalo, l'episodio "Byte the Silence", dedicato al cyberbullismo, è scaricabile gratuitamente per uso personale. Perché la miglior difesa, in fondo, è una bella storia. 👉 Scopri tutto su https://betti.redhotcyber.com/

redhotcyber.comJul 31, 2025extracted