Search/ntt

● Vendor

ntt

View graph Watch Export

Known CVEs

Highest CVSS

—

In KEV

Vendor

photopt

Connections

29 relationships

不正アクセスで一部停止中のNTT西子会社レンタルサーバ、復旧見通しを公表　調査完了は8月末見込み

不正アクセスで一部停止中のNTT西子会社レンタルサーバ、復旧見通しを公表調査完了は8月末見込み NTT西日本子会社のNTTスマートコネクト（大阪市北区）は8月19日、不正アクセスを受けて一部停止しているレンタルサーバサービス「スマイルサーバ」について、復旧に向けた見通しを発表した。調査でユーザーのデータに影響がないと確認できた場合、サービス停止時点の環境を「復旧環境」として用意し、9月中旬ごろの提供開始を目指す。不正アクセスは7月24日に確認した。スマイルサーバの一部サーバ設備2台（「jm9」「jm10」）が対象で、被害の拡大を防ぐため同日午後1時に両設備上の全サービスを停止。この2台以外のサーバを利用するユーザーへの影響はないとしている。現在は外部の専門調査機関による調査を実施中で、原因や影響範囲、データへの影響の有無を確認している。完了は8月末の見込み。関係省庁には所定の報告を完了しており、同日までに確認した範囲では、ユーザーの情報が外部に漏えいした事実はないという。調査の結果、漏えいが判明した場合は対象ユーザーに速やかに個別連絡する。停止中の設備に保存してあるユーザーのデータは、現時点で返却できていない。設備が調査対象であり、不正アクセスの影響を受けた可能性を否定できないため、データを渡すとユーザー側の環境で二次被害が生じる恐れがあるとの判断だ。このためユーザーはWebサイトやメール環境の再構築が必要になっており、27日からは代替サーバを提供している。復旧環境の提供が始まれば、ユーザーは復旧環境からデータを取得して代替サーバで活用するか、復旧環境をそのまま使い続けるかを選べるようになる。ただし提供時期は調査結果により前後する可能性があり、確度の高い見通しは調査完了後にあらためて案内するとしている。同社は不正アクセスの確認当日に対策本部を設置し、原因調査やユーザー対応を進めてきた。再発防止策は調査結果を踏まえて策定する。ユーザーに対しては、停止中の設備で使っていたFTPアカウントやメールアカウントと同じパスワードを他サービスでも使っている場合は変更を検討するよう呼び掛けたほか、同社を装う不審なメールや電話への注意も促した。 ITmedia NEWS読者調査当社では企業のビジネストレンドを明らかにするために読者調査を行っております。ご回答いただきました方の中から抽選で5名の方にAmazonギフトカード（3000円分）をプレゼント。何卒ご協力お願い致します。回答はこちらから！ Copyright © ITmedia, Inc. All Rights Reserved.

itmedia.co.jpAug 20, 2026extracted

ドコモが選んだAPI保護の次の一手　AIエージェントを統制する「門番」とは

itmedia.co.jpAug 6, 2026extracted

Power shortages could slow AI data center expansion

Power shortages could slow AI data center expansion AI adoption is increasing demand for data center capacity at the same time operators are running into limits around power, equipment, land, and permitting, according to NTT Data. Access to electricity is becoming a deciding factor in where new data centers are built, when new capacity comes online and how quickly AI projects can expand. Distribution of new data center capacity by region (Source: NTT Data) AI changes infrastructure planning Enterprise workloads spread computing demand across large numbers of servers with relatively predictable power requirements. AI infrastructure concentrates processing into dense clusters of GPU-based systems that consume significantly more electricity and generate more heat. Those environments require high-bandwidth networking and advanced cooling systems to support continuous operation. That changes the planning process for new facilities. Data center operators are designing larger campuses with greater electrical capacity, while enterprises evaluating AI deployments are paying closer attention to infrastructure availability alongside compute resources. AI workloads will continue increasing their share of installed capacity through the end of the decade, showing continued investment in AI training and inference infrastructure. “AI demand is accelerating faster than many parts of the underlying infrastructure system can respond,” said Doug Adams, CEO and President, NTT Global Data Centers. “The challenge now is not simply scaling capacity, but removing the operational and supply-side constraints that delay deployment and erode the economics of AI investment.” Electricity affects every stage of expansion Power has become a planning constraint because every new data center depends on grid capacity before construction can begin. Land can be acquired and buildings can be designed, yet projects still depend on utilities delivering enough electricity to support high-density computing environments. Transmission infrastructure, substations and grid connections all influence deployment schedules. Data centers account for about 1.5% of global electricity consumption, with demand concentrated in established data center markets where facilities can represent 20% to 30% of local electricity use. Operators are working directly with utilities on demand-response programs and dedicated infrastructure investments to support additional electrical load. Those efforts help utilities prepare for continued growth in AI infrastructure and improve long-term planning for new capacity. Equipment availability affects deployment timelines Power infrastructure depends on equipment with long manufacturing cycles. Transformers, switchgear and backup generation systems each require procurement, installation and commissioning before facilities become operational. The analysis identifies supply constraints across several of those categories, with large power transformers carrying lead times measured in years and switchgear requiring extended delivery schedules. GPU availability remains another dependency for operators expanding AI capacity, adding pressure across multiple parts of the supply chain at the same time. Those timelines influence construction schedules even after financing, permitting and site selection have been completed. Regional differences are becoming more visible The United States continues to hold the largest share of global installed capacity and remains the largest market for new development. Europe faces greater pressure from electricity availability, regulation and community approval processes, giving it the highest infrastructure stress score among the regions evaluated in the outlook. Asia-Pacific continues expanding capacity with comparatively lower projected infrastructure stress, supported by continued investment across several markets. Those regional differences are likely to influence where future AI infrastructure is deployed as operators balance power availability, construction timelines and customer demand.

helpnetsecurity.comJul 7, 2026extracted

AI infrastructure is cracking under sovereignty demands

AI infrastructure is cracking under sovereignty demands AI deployments are moving into environments with tighter controls around data, infrastructure, and system operations. Organizations are building AI systems across multiple providers, platforms, and computing environments while managing governance, security, and compliance obligations within defined boundaries. NTT DATA’s 2026 Global AI Report A Playbook for Private and Sovereign AI examined these conditions in more than 2,500 organizations. About 35% of CAIOs identify enabling private and sovereign AI as their biggest barrier to adoption, often requiring significant changes to infrastructure. Defining private and sovereign AI Private AI focuses on controlling access to sensitive data and keeping that data inside organizational boundaries. Sovereign AI adds demands around where data resides, how it moves between regions, and where AI systems can process it. “As AI evolves, private and sovereign approaches are testing enterprise readiness,” said Abhijit Dubey, CEO and Chief AI Officer, NTT DATA. “The organizations that are succeeding are going beyond regulatory compliance and risk mitigation. They are building the operating foundation for AI that can perform across markets, jurisdictions and business environments. Our research shows AI leaders are pulling ahead by treating architecture, infrastructure and governance as strategic requirements.” Cross-border data restrictions have become a major challenge because data can move legally at a slower rate than AI architectures assume. This creates competing priorities around performance, compliance, efficiency, and control. Organizations continue to translate private and sovereign AI demands into operating models and architecture. AI leaders build those conditions into infrastructure and governance decisions early in deployment planning. Their operating environments support movement from pilot projects to larger deployments in regulated settings. Organizations expand planning around AI control About 95% of organizations consider private or sovereign AI important to their AI strategy, and 96% are considering relocating AI infrastructure to specific regions because of geopolitical pressures and supply chain concerns. These considerations fall into three categories. Mandated AI sovereignty refers to legal or geopolitical requirements for domestic control. Regulated privacy requires organizations to demonstrate auditable control over data, models, and operations. Strategic AI autonomy reflects efforts to gain greater control over intellectual property, costs, and vendor dependence. About 98% of C-suite executives say it is imperative to establish a private domain that protects proprietary intellectual property and sensitive data through a GenAI model that cannot be trained publicly. Infrastructure and data become design constraints Nearly every company is reviewing how to integrate AI into legacy environments, and 96% say their infrastructure is slowing AI adoption. Organizations are designing AI architectures to support multiple jurisdictions, each with distinct data, regulatory, and infrastructure constraints tied to private and sovereign AI. Companies globally cite privacy violations and misuse of customer data related to AI and GenAI as key concerns because keeping data local requires storage capacity, processing power, and resilient networks within defined boundaries. Data privacy and sovereignty across regions and environments are considered the top security or compliance governance concern, and 57% of CEOs rank them as a risk for their organizations. Infrastructure, data, and model design sit at the center of sovereignty strategies, and organizations are beginning to separate data from intelligence. Different AI workloads create different demands for computing density, network design, resilience, and data gravity. Regulatory and compliance obligations can make workload placement as important as performance considerations. Organizations are adopting hybrid architectures that reserve controlled environments for sensitive data, predictable performance, and regulatory oversight. Lower-risk workloads run in other environments. Execution gaps and governance challenges Most organizations recognize that AI must operate in controlled and compliant environments, and many continue to determine how to build scalable architectures and operating models around those demands. Private and sovereign AI conditions add complexity and create execution and confidence gaps. Sovereign AI investments in the European Union are largely driven by regulation. In parts of the Middle East, political priorities and national strategy often influence investment decisions. Industries with significant consequences associated with failure, including public sector organizations, healthcare, natural resources, and manufacturing, are more likely to adopt sovereign approaches to designing and deploying AI solutions over the next two years. AI leaders are taking a more structured approach to governance by embedding it from the beginning of AI initiatives. They are more likely to adopt centralized governance structures and support federated operating models. They also tend to formalize accountability through executive-backed steering committees that bring together business, legal, and security stakeholders.

helpnetsecurity.comMay 19, 2026extracted

アサヒのランサム被害の教訓を生かせ　流通大手がISAC設立、その背景と課題を読みとく

�T�C�o�[�U��g1�Ђ̖��h�ł͍ς܂Ȃ��Ȃ��A��ʑ�肪��B�A�T�q��NTT�炪�ƊE��f�ŋ��Џ��L��V��Șg�g�݁u��ISAC�v�iInformation Sharing and Analysis Center�j�𗧂��グ��B��A��̐^��͖{��ɔ��̂��B�A�g�̗��ɐ��މۑ��l��B ��̋L��͉��ł��B��o�^�i��j��ƑS�Ă��܂��B �@�A�T�q�O��[�v�W��p��ƃg��C�A��z�[��f�B��O�X�A�O�H�H�i�ANTT��2026�N4��6��A��ʋƊE��ƂȂ�u��ISAC�v�N4��ɐ��ɐݗ��Ɣ��\��B �@��c�̂�ʂ��Џ��E�C��V�f��g��̋��L�ƕ��͂ɂ��āA��ʋƊE�S�̂ŃT�C�o�[�Z�L��e�B�́u�W�c�h��́v�̌��}��Ƃ��Ă��B �@�T�C�o�[�U��̌��ɔ��A�T�v��C��F�[��S�̂̎��Ɗ��ɑ傫�Ȕ�Q��Ă��B��Ɉ��H��i�E��p�i�Ȃǂ𒆐S�Ƃ��ʋƊE�́A��≵�A��ٖ��ɘA�g��O�w�\��Ő��藧��Ă��A��ЂŔ��T�C�o�[�C��V�f��g��A��~�╨��A�X�܂̉c�ƒ�~�Ȃǂ�ʂ��āA�Љ�⍑��ɍL�͂ȉe��y�ڂ��X�N��B �@��̑��A�C��V�f��g�Ή��͊�ƒP�̂ł̑Ώ��Ɍ��E��B�ƊE��f��A��ʋƊE�ő_��₷��U��p�^�[��Ǝ�i��Ⴍ�j��v��Ɋe�Ђɋ��L��d�g�݂��K�v��B �@��āA�A�T�q�O��[�v�W��p��ƃg��C�A��z�[��f�B��O�X�A�O�H�H�i�ANTT�́A�ݗ��N�l�e�ЂƋ��ɗ��ʋƊE�ɂ��Z�L��e�B��邱�Ƃ�ړI�Ƃ��ė��ISAC��ݗ��B �@��ISAC�̖ړI�͈ȉ��̒ʂ肾�B�ړI��ƂɃ��[�L��O�O��[�v��ݒu��A�N�Ԃ�ʂ��ċc�_��[�߁A��I�Ȑ��ʕ��ƂɎ��{��B��Ƃ́A��ʋƊE�ɓ��Z�L��e�B��̃i��b�W��d�g�݂��B �@��ISAC�ݗ��N�l�e�Ђ͈ȉ��̒ʂ肾�B�o�ώY�ƏȂ��I�u�U�[�o�[�Ƃ��ĎQ��\�肾�Ƃ��B ��ISAC�ݗ��̔w�i�ɂ́A�ߔN�̃T�C�o�[�U��T�v��C��F�[��S�̂�W�I�Ƃ��g�ʁh�̍U��ւƕω��Ă��錻��B��ɗ��ʋƊE�́A��E��E��ڂɌ��ѕt��\��A��Ђ̐N�Q��ɑS�̂̋@�\�s�S�ւƔg�y��B�U��҂ɂƂ��Ắu�ł��̗ǂ��W�I�v�̈��B��ہA�A�T�q�O��[�v�z�[��f�B��O�X��A�X�N��ւ̃��T��E�F�A��Q�ł́A�Ɩ��╨��ւ̉e��L�͂ɋy�сA��ƒP�̖̂��ɂƂǂ܂�Ȃ��X�N��݉��B ��Ӗ��ŋƊE��f��ăT�C�o�[�Z�L��e�B��鍡��̎��g�݂ɂ͑傫�ȈӋ��邪�AISAC�̐ݗ��̂��h��͌��ƂȂ�Ȃ��_�ɂ͒��ӂ��K�v��B�ډ��̉ۑ�́u�ǂ��܂Ń��A��ȏ��L��邩�v��낤�B�C��V�f��g��͊�Ƃ̐M�p��@�I��X�N�ɒ��邽�߁A�\�w�I�ȏ�L�ɂƂǂ܂�A��͑傫��Ȃ��B�܂��A��L��ꂽ��e�Ђ��v��Ɏ��Њ��ɓK�p�ł��邩�ǂ��Ƃ��g�^�p�́h�̍��A��ʂ��v��ɂȂ�B ��̑��A��ISAC��ǂ��܂Œ��Ƃ�T�v��C��[�w��߂邩��T�v��C��F�[��S�̂̋��}��ŏd�v�ȗv�f��B�U��҂͉��X�ɂ��ăZ�L��e�B��蔖�Ȓ��E��Ƃ��N�_�Ƀ��T��E�F�A�U��d�|��P�[�X��ڗ��B ��ISAC�͊ԈႢ�Ȃ��d�v�Ȉ��A�{��́u�g�D��邱�Ɓv�ł͂Ȃ��A�u�@�\��邱�Ɓv�ɂ��B��Ђ��i��钆�ŁA��̘g�g�݂��P�Ȃ��̏�ɂƂǂ܂�̂��A��Ƃ��g�D�ւƐi��ł��邩�B��̊��Ɋ��҂��B�i�c��j Copyright © ITmedia, Inc. All Rights Reserved.

atmarkit.itmedia.co.jpApr 7, 2026extracted

Cybersecurity jobs available right now: March 24, 2026

helpnetsecurity.comMar 24, 2026extracted

North Korean Hackers Abuse VS Code Auto-Run Tasks to Deploy StoatWaffle Malware

The North Korean threat actors behind the Contagious Interview campaign, also tracked as WaterPlum, have been attributed to a malware family tracked as StoatWaffle that's distributed via malicious Microsoft Visual Studio Code (VS Code) projects. The use of VS Code "tasks.json" to distribute malware is a relatively new tactic adopted by the threat actor since December 2025, with the attacks leveraging the "runOn: folderOpen" option to automatically trigger its execution every time any file in the project folder is opened in VS Code. "This task is configured so that it downloads data from a web application on Vercel regardless of executing OS [operating system]," NTT Security said in a report published last week. "Though we assume that the executing OS is Windows in this article, the essential behaviors are the same for any OS." The downloaded payload first checks whether Node.js is installed in the executing environment. If it's absent, the malware downloads Node.js from the official website and installs it. Subsequently, it proceeds to launch a downloader, which periodically polls an external server to fetch a next-stage downloader that exhibits identical behavior by reaching out to another endpoint on the same server and executing the received response as Node.js code. StoatWaffle has been found to deliver two different modules - A stealer that captures credentials and extension data stored in web browsers (Chromium-based browsers and Mozilla Firefox) and uploads them to a command-and-control (C2) server. If the compromised system runs on macOS, it also steals the iCloud Keychain database. A remote access trojan (RAT) that communicates with the C2 server to fetch and execute commands on the infected host. The commands allow the malware to change the current working directory, enumerate files and directories, execute Node.js code, upload file, recursively search the given directory and list or upload files matching a certain keyword, run shell commands, and terminate itself. "StoatWaffle is a modular malware implemented by Node.js, and it has Stealer and RAT modules," the Japanese security vendor said. "WaterPlum is continuously developing new malware and updating existing ones." The development coincides with various campaigns mounted by the threat actor targeting the open-source ecosystem - A set of malicious npm packages that distribute the PylangGhost malware, marking the first time the Python-based backdoor has been propagated via npm packages. A campaign known as PolinRider has implanted a malicious obfuscated JavaScript payload in hundreds of public GitHub repositories that culminates in the deployment of a new version of BeaverTail, a known stealer and downloader malware attributed to Contagious Interview. Among the compromises are four repositories belonging to the Neutralinojs GitHub organization. The attack is said to have compromised the GitHub account of a long-time neutralinojs contributor with organization-level write access to force-push JavaScript code that retrieves encrypted payloads in Tron, Aptos, and Binance Smart Chain (BSC) transactions to download and run BeaverTail. The victims are believed to have been infected via a malicious VS Code extension or an npm package. Microsoft, in an analysis of Contagious Interview this month, said the threat actors achieve initial access to developer systems through "convincingly staged recruitment processes" that mirror legitimate technical interviews, ultimately persuading victims into running malicious commands or packages hosted on GitHub, GitLab, or Bitbucket as part of the assessment. In some cases, targets are approached on LinkedIn. However, the individuals chosen for this social engineering attack are not junior developers, but rather founders, CTOs, and senior engineers in the cryptocurrency or Web3 sector, who are likely to have elevated access to the company's tech infrastructure and cryptocurrency wallets. A recent incident involved the attackers unsuccessfully targeting the founder of AllSecure.io via a fake job interview. The hacking group is known to create fake LinkedIn company pages to lend credibility to the attacks, and set up GitHub accounts for malware delivery. Some attacks have also leveraged a popular social engineering tactic known as ClickFix to distribute malware like PylangGhost via bogus skills assessment tasks. Additionally, the threat actor has a history of publishing malicious packages to the npm registry. "While these attacks appear to have a central goal of cryptocurrency theft, the threat group has demonstrated its intention to use initial access for further supply chain compromise or corporate espionage," Sophos said, noting that the adversary strategically selects follow-on payloads after profiling victims' systems. The cybersecurity vendor is tracking the activity under the name Nickel Alley. Some of the key malware families deployed as part of these attack chains include OtterCookie (a backdoor capable of extensive data theft), InvisibleFerret (a Python-based backdoor), and FlexibleFerret (a modular backdoor implemented in both Go and Python). While InvisibleFerret is known to be typically delivered via BeaverTail, recent intrusions have been found to distribute the malware as a follow-on payload, after leveraging initial access obtained through OtterCookie. It's worth mentioning here that FlexibleFerret is also referred to as WeaselStore. Its Go and Python variants go by the monikers GolangGhost and PylangGhost, respectively. In a sign that the threat actors are actively refining their tradecraft, newer mutations of the VS Code projects have eschewed Vercel-based domains for GitHub Gist-hosted scripts to download and execute next-stage payloads that ultimately lead to the deployment of FlexibleFerret. These VS Code projects are staged on GitHub. "By embedding targeted malware delivery directly into interview tools, coding exercises, and assessment workflows developers inherently trust, threat actors exploit the trust job seekers place in the hiring process during periods of high motivation and time pressure, lowering suspicion and resistance," the tech giant said. In response to the ongoing abuse of VS Code Tasks, Microsoft has included a mitigation in the January 2026 update (version 1.109) that introduces a new "task.allowAutomaticTasks" setting, which defaults to "off" in order to improve security and prevent unintended execution of tasks defined in "tasks.json" when opening a workspace. "The update also prevents the setting from being defined at the workspace level, so malicious repositories with their own .vscode/settings.json file should not be able to override the user (global) setting," Abstract Security said. "This version and the recent February 2026 (version 1.110) release also introduce a secondary prompt that warns the user when an auto-run task is detected in a newly opened workspace. This acts as an additional guard after a user accepts the Workspace Trust prompt." In recent months, North Korean threat actors have also been engaging in a coordinated malware campaign targeting cryptocurrency professionals through LinkedIn social engineering, fake venture capital firms, and fraudulent video conferencing links. The activity shares overlap with clusters tracked as GhostCall and UNC1069. "The attack chain culminates in a ClickFix-style fake CAPTCHA page that tricks victims into executing clipboard-injected commands in their Terminal," MacPaw's Moonlock Lab said. "The campaign is cross-platform by design, delivering tailored payloads for both macOS and Windows." The findings come as the U.S. Department of Justice (DoJ) announced the sentencing of three men -- Audricus Phagnasay, 25, Jason Salazar, 30, and Alexander Paul Travis, 35 -- for their roles in furthering North Korea's fraudulent information technology (IT) worker scheme in violation of international sanctions. All three individuals previously pleaded guilty in November 2025. Phagnasay and Salazar were both sentenced to three years of probation and a $2,000 fine. They were also ordered to forfeit the illicit proceeds gained by participating in the wire fraud conspiracy. Travis was sentenced to one year in prison and ordered to forfeit $193,265, the amount earned by North Koreans by using his identity. "These men practically gave the keys to the online kingdom to likely North Korean overseas technology workers seeking to raise illicit revenue for the North Korean government — all in return for what to them seemed like easy money," Margaret Heap, U.S. attorney for the Southern District of Georgia, said in a statement. Last week, Flare and IBM X-Force published a detailed look at the IT worker operation and its internal structure, while highlighting how IT workers attend prestigious universities in North Korea and go through a rigorous interview process themselves before joining the scheme. They are "considered elite members of North Korean society and have become an indispensable part of the overall North Korean government's strategic objectives," the companies noted. "These objectives include, but are not limited to, revenue generation, remote employment activity, theft of corporate and proprietary information, extortion, and providing support to other North Korean groups."

thehackernews.comMar 23, 2026extracted

Cybersecurity jobs available right now: March 17, 2026

helpnetsecurity.comMar 17, 2026extracted

「この電話、詐欺かも」警告　NTTタウンページが無料アプリ公開

「この電話、詐欺かも」警告 NTTタウンページが無料アプリ公開 NTTタウンページは3月5日、詐欺と思われる番号から着信した際、遮断したり警告を表示したりできるスマートフォンアプリ「詐欺対策 by NTTタウンページ」の無料提供を始めた。警察庁から推奨認定を受けた。詐欺や、詐欺と推定される番号からの着信時／発信時に、自動遮断か警告表示できるアプリ。警察庁などが把握している特殊詐欺に使われた電話番号情報に加え、協業先のトビラシステムズが独自に構築・運用する迷惑情報データベースに登録された危険番号を活用する。トビラシステムズのデータベースは、利用者からの申告情報や独自の調査などをもとに日々更新されているため、新たな詐欺手口や番号にも迅速に対応できる点が特徴だ。また、「iタウンページ」に登録されている企業情報を基に、企業からの着信時には発信元の企業名称を表示する。警察庁が公表する特殊詐欺等に関する防犯情報もアプリ内で通知する。 Copyright © ITmedia, Inc. All Rights Reserved.

itmedia.co.jpMar 5, 2026extracted

Japanese tech giant Advantest hit by ransomware attack

Advantest Corporation disclosed that its corporate network has been targeted in a ransomware attack that may have affected customer or employee data. Preliminary investigation results revealed that an intruder gained access to certain parts of the company’s network on February 15. Tokyo-based Advantest is a global leader in testing equipment for semiconductors, measuring instruments, digital consumer products, and wireless communications equipment. The company employs 7,600 people, has an annual revenue of more than $5 billion, and a market capitalization of $120 billion. On February 15, the firm detected unusual activity in its IT environment, prompting a response in accordance with incident response protocols, including the isolation of affected systems. As part of its response, the company contracted third-party cybersecurity specialists to help isolate the threat and investigate its impact. “Preliminary findings appear to indicate that an unauthorized third party may have gained access to portions of the company’s network and deployed ransomware,” Advantest states. “If our investigation determines that customer or employee data was affected, we will notify impacted persons directly and provide guidance on protective measures.” Currently, no data theft has been confirmed, but Advantest noted that this may change as more information emerges from the ongoing investigation. Should customers or staff be determined to be impacted, Advantest will notify them directly and provide instructions on mitigating the associated risks. At the time of writing, no ransomware groups have claimed the attack on the Japanese tech giant. BleepingComputer has contacted Advantest directly to request more details about the attack, but we have not heard back by publishing time. Multiple Japanese companies have been the target of cyberattacks recently, as several high-profile entities suffered data breaches and operational disruptions. Notable examples include Washington Hotel, Nissan, Muji, Asahi, and NTT. Advantest says that the investigation continues and that it will provide updates on the incident when new details emerge. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

bleepingcomputer.comFeb 20, 2026extracted

「VPN装置」が主なランサムウェア侵入口　NTT-AT、その“侵害リスク”を4手法で評価

NTT�A�h�o��X�e�N�m��W�́AVPN��u�ɓ��đ��w�I�Ȑf�f��{��uVPN�Z�L��e�B�f�f�T�[�r�X�v�̒��J�n��B ��̋L��͉��ł��B��o�^�i��j��ƑS�Ă��܂��B �@NTT�A�h�o��X�e�N�m��W�i�ȉ��ANTT-AT�j��2026�N1��14��AVPN�iVirtual Private Network�j��u�ɓ��Z�L��e�B�f�f�T�[�r�X�uVPN�Z�L��e�B�f�f�T�[�r�X�v�̒�1��15��J�n��B �@��T�[�r�X�́A�O��E��f�f�A�Z�L��e�B�q�A��O�A�_�[�NWeb�̘R��ID��A�N�Q��V�i��I�Č��ꊇ�Œ��鑽�w�f�f��Ƃ��B �@�e��[�N�̕��y�ɂ��A��̊�Ƃ�VPN��u��l�b�g��[�N�̏d�v�ȓ��ƂȂ��Ă��AVPN��u�̐Ǝ�i��Ⴍ�j��ݒ�~�X��˂��U��}��Ă��B�x�@��J��A��P�[�g��u�ߘa7�N�㔼��ɂ��T�C�o�[��Ԃ��߂��鋺�Ђ̏��ɂ��āv�i�Q�l�j�ɂ��ƁA��T��E�F�A�i�g��v��^�}��E�F�A�j��Q��6��ȏオVPN��u�o�R�Ŕ��Ă��Ƃ��B�܂��AVPN��u�o�R�Ȃǂɂ�郉��T��E�F�A��Q�z��O�N��1.5�{�ɑ��Ă��B �@�u�U��҂͘R��ID��p�X��[�h��g�p��Ċ�Ƃ��X�L��Ă��A��Ƃ��łȂ��Ƃ��W�I�ɂȂ��Ă��v�iNTT-AT�j �@��T�[�r�X�͈ȉ��4�̎�@��g�ݍ��킹�AVPN��u�̐N�Q��X�N��]��B �@NTT-AT�̓T�[�r�X��4�̓��̂悤�ɐ��Ă��B �@VPN�Z�L��e�B�f�f�T�[�r�X�̒��i�͈ȉ��̒ʂ�B �@NTT-AT�͍��A�N��E�hVPN��Secure Access Service Edge�iSASE�j�ȂǃT�[�r�X�̑ΏۂƂȂ�VPN��ʂ��g�傷��ƂƂ��ɁA�Z�L��e�B�f�f��̑��Ă܂ł��X�g�b�v�Œ��j��B Copyright © ITmedia, Inc. All Rights Reserved.

atmarkit.itmedia.co.jpFeb 19, 2026extracted

Washington Hotel in Japan discloses ransomware infection incident

The Washington Hotel brand in Japan has announced that that its servers were compromised in a ransomware attack, exposing various business data. The hospitality group has established an internal task force and engaged external cybersecurity experts to assess the impact of the intrusion, determine whether customer data was compromised, and coordinate recovery efforts. Washington Hotel, a brand operating under Fujita Kanko Inc. (WHG Hotels), is a business-focused hospitality chain with 30 locations across Japan. WHG has 11,000 rooms over its properties and has nearly 5 million guests every year. According to the company’s disclosure, hackers breached its network on Friday, February 13, 2026, at 22:00 (local time). The IT staff immediately disconnected servers from the internet to prevent the attack from spreading on the network. The organization states that it started consulting with the police and external cybersecurity experts. Although an investigation is ongoing, Washington Hotel can confirm that the attacker gained access to various business data stored on the affected servers. Customer data is unlikely to be exposed because the company stores this information on servers managed by a separate company, for which no unauthorized access has been confirmed. The incident is impacting operations at some Washington Hotel brand properties, including the temporary unavailability of credit card terminals. Besides that, the firm says it recorded no significant operational disruption. The financial impact of the incident is currently under review. Washington Hotel promised to provide updates if any additional relevant details emerge. As of writing, no ransomware groups have claimed the Washington Hotel on known dark-web-based extortion portals that BleepingComputer monitors. Multiple companies in Japan have been targeted by hackers lately. Some of the recent incidents include global automaker Nissan, retail giant Muji, the largest brewer in the country, Asahi, and telecom giant NTT. Although not necessarily related to the breach at Washington Hotel, JPCERT/CC disclosed late last week that hackers were exploiting an arbitrary command injection flaw in Soliton Systems’ FileZen products, tracked under CVE-2026-25108. The file-sharing appliance is widely used by Japanese companies and was also targeted in 2021. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

bleepingcomputer.comFeb 16, 2026extracted

React2Shell Vulnerability Actively Exploited to Deploy Linux Backdoors

The security vulnerability known as React2Shell is being exploited by threat actors to deliver malware families like KSwapDoor and ZnDoor, according to findings from Palo Alto Networks Unit 42 and NTT Security. "KSwapDoor is a professionally engineered remote access tool designed with stealth in mind," Justin Moore, senior manager of threat intel research at Palo Alto Networks Unit 42, said in a statement. "It builds an internal mesh network, allowing compromised servers to talk to each other and evade security blocks. It uses military-grade encryption to hide its communications and, most alarmingly, features a 'sleeper' mode that lets attackers bypass firewalls by waking the malware up with a secret, invisible signal." Moore told The Hacker News that the backdoor has been identified in two distinct regions and industries, and that it's likely the work of Chinese nation-state actors, based on the malware's code structure and functional overlap with previous Linux backdoors, along with other tools used by adversaries from the region. "This limited footprint is consistent with the behavior of a sophisticated, custom-engineered backdoor," Moore added. "Threat actors rarely risk exposing such thoughtfully written and engineered tools in widespread campaigns but instead, they reserve them for precise, high-value targeting." The cybersecurity company noted that it was previously mistakenly classified as BPFDoor, adding that the Linux backdoor offers interactive shell, command execution, file operations and lateral movement scanning capabilities. It also impersonates a legitimate Linux kernel swap daemon to evade detection. The initial misclassification of KSwapDoor as BPFDoor, according to Moore, stemmed from the use of a technique called Raw Socket Sniffing, which enables the malware strains to read network traffic directly from the wire without opening a visible port. It's worth noting that BPFDoor is designed to create a special packet sniffing socket that monitors for incoming traffic with a specific Magic Byte sequence to trigger its malicious behavior. "Because we discovered this specific 'listening' code inside KSwapDoor, we initially flagged it as BPFDoor based on that shared signature," Moore explained. "However, the reality is that KSwapDoor includes this sniffing capability merely as a dormant backup entry method; its main engine is actually a sophisticated peer-to-peer router that allows for complex lateral movement, a capability that BPFDoor completely lacks." In a related development, NTT Security said organizations in Japan are being targeted by cyber attacks exploiting React2Shell to deploy ZnDoor, a malware that's been assessed to be detected in the wild since December 2023. The attack chains involve running a bash command to fetch the payload from a remote server (45.76.155[.]14) using wget and executing it. A remote access trojan, it contacts the same threat actor-controlled infrastructure to receive commands and execute them on the host. Some of the supported commands are listed below - shell, to execute a command interactive_shell, to launch an interactive shell explorer, to get a list of directories explorer_cat, to read and display a file explorer_delete, to delete a file explorer_upload, to download a file from the server explorer_download, to send files to the server system, to gather system information change_timefile, to change the timestamp of a file socket_quick_startstreams, to start a SOCKS5 proxy start_in_port_forward, to start port forwarding stop_in_port, to stop port forwarding The disclosure comes as the vulnerability, tracked as CVE-2025-55182 (CVSS score: 10.0), has been exploited by multiple threat actors, Google identifying at least five China-nexus groups that have weaponized it to distribute an array of payloads - UNC6600, to deliver a tunneling utility named MINOCAT UNC6586, to deliver a downloader named SNOWLIGHT UNC6588, to deliver a backdoor named COMPOOD UNC6603, to deliver an updated version of a Go backdoor named HISONIC that uses Cloudflare Pages and GitLab to retrieve encrypted configuration and blend in with legitimate network activity UNC6595, to deliver a Linux version of ANGRYREBEL (aka Noodle RAT) Microsoft, in its own advisory for CVE-2025-55182, said threat actors have taken advantage of the flaw to run arbitrary commands for post-exploitation, including setting up reverse shells to known Cobalt Strike servers, and then dropping remote monitoring and management (RMM) tools such as MeshAgent, modifying the authorized_keys file, and enabling root login. Some of the payloads delivered in these attacks include VShell, EtherRAT, SNOWLIGHT, ShadowPad, and XMRig. The attacks are also characterized by the use of Cloudflare Tunnel endpoints ("*.trycloudflare.com") to evade security defenses, as well as conducting reconnaissance of the compromised environments to facilitate lateral movement and credential theft. The credential harvesting activity, the Windows maker said, targeted Azure Instance Metadata Service (IMDS) endpoints for Azure, Amazon Web Services (AWS), Google Cloud Platform (GCP), and Tencent Cloud with the end goal of acquiring identity tokens to burrow deeper into cloud infrastructures. "Attackers also deployed secret discovery tools such as TruffleHog and Gitleaks, along with custom scripts to extract several different secrets," the Microsoft Defender Security Research Team said. "Attempts to harvest AI and cloud-native credentials, such as OpenAI API keys, Databricks tokens, and Kubernetes service‑account credentials, were also observed. Azure Command-Line Interface (CLI) (az) and Azure Developer CLI (azd) were also used to obtain tokens." In another campaign detailed by Beelzebub, threat actors have been observed exploiting flaws in Next.js, including CVE-2025-29927 and CVE-2025-66478 (the same React2Shell bug before it was rejected as a duplicate), to enable systematic extraction of credentials and sensitive data - .env, .env.local, .env.production, .env.development System environment variables (printenv, env) SSH keys (~/.ssh/id_rsa, ~/.ssh/id_ed25519, /root/.ssh/*) Cloud credentials (~/.aws/credentials, ~/.docker/config.json) Git credentials (~/.git-credentials, ~/.gitconfig) Command history (last 100 commands from ~/.bash_history) System files (/etc/shadow, /etc/passwd) The malware also proceeds to create persistence on the host to survive system reboots, install a SOCKS5 proxy, establish a reverse shell to "67.217.57[.]240:888," and install a React scanner to probe the internet for further propagation. The activity, codenamed Operation PCPcat, is estimated to have already breached 59,128 servers. "The campaign shows characteristics of large-scale intelligence operations and data exfiltration on an industrial scale," the Italian company said. The Shadowserver Foundation is currently tracking over 111,000 IP addresses vulnerable to React2Shell attacks, with over 77,800 instances in the U.S., followed by Germany (7,500), France (4,000), and India (2,300). Data from GreyNoise shows that there are 547 malicious IP addresses from the U.S., India, the U.K., Singapore, and the Netherlands partaking in the exploitation efforts over the past 24 hours. (The story was updated after publication to include additional details of KSwapDoor.)

thehackernews.comDec 16, 2025extracted

China’s Cyber Silence is More Worrying Than Russia’s Noise, Chief Cybersecurity Strategist Says

Mihoko Matsubara is chief cybersecurity strategist at Japan-based NTT (Nippon Telephone and Telegraph Company). NTT was founded in 1952, privatized in 1985, and has developed into a major international telecommunications firm with hundreds of thousands of employees and a presence in more than 70 countries. Previously, Matsubara had been VP and public sector CSO Asia-Pacific at Palo Alto Networks, a cyber security policy director at Intel, a geopolitical cybersecurity analyst at Hitachi, advisor to the Japanese government on cybersecurity strategy, and spent nine years as a foreign liaison officer for the Japanese ministry of defense – with a John Hopkins MA in international relations along the way. She has a deep understanding of global cybersecurity and its interplay with geopolitics; she talks to different companies in different countries; and engages with multiple think tanks. She has become a recognized cybersecurity thought leader – and it is in this context she talked with SecurityWeek. We focused on three areas: Japan, international geopolitics, and the future. Japan. Why does the world not hear about Japanese malicious hackers in the same way it hears about Russian, Chinese, European and American hackers and hacking groups? “Blackhats exist and have been arrested and convicted in Japan, but there are possibly fewer examples, and they are usually solitary actors,” she said. She suspects the reason may be a form of cultural isolation: fewer because unemployment for cyber adept youngsters (in their 20s to 30s) is lower in Japan than many other countries – so, it is easier to gain legitimate employment – and solitary because of the language barrier. “I’m not aware of any Japan-based cybercrime syndicates. If a Japanese national wanted to join a foreign group, he would have to learn English or perhaps Russian – and other languages are very, very different to Japanese.” Geopolitics. We are in an age of rising geopolitical tension. Given the relationship between geopolitics and aggressive cyber activity and cyberwar, can we learn anything from Ukraine’s remarkable cyber resilience in the face of outright kinetic war with Russia? Ukraine, she believes, demonstrates the need for two fundamentals in cybersecurity: constant resilience enhancement, and the importance of international cooperation and intelligence sharing. “Ukraine had eight years between the annexation of Crimea in 2014 and the full-scale Russian invasion in 2022. During this period, it suffered repeated disruptive cyberattacks against its critical infrastructure – but it survives.” It’s not that it does anything new, it’s just that it did and does what is necessary very well. And that’s a lesson for everyone. “We must do defense in depth, and we must have good intelligence with continuous red teaming. Everything the Ukrainians have been doing we’ve known for years,” she continues. This includes strengthening resilience and improving international cooperation for hardware, software and threat intelligence. But we should do it now and continuously. “Because once war starts, it will be difficult to allocate resources.” There’s an interesting sidebar to the Russia/Ukraine conflict. Russian state actors and politically aligned cybercriminals have become increasingly destructive in their cyber activities against the Ukraine-supporting West. Compare this to China, which is more closely aligned with Russia than with America or Europe. It is certainly cyber active, but not cyber destructive. “We have, from open source information, never seen China aim destructive cyber operations against our critical infrastructure,” comments Matsubara. The go-to explanation is that China may wish to avoid cyber retaliation from the NSA. Matsubara has a different, and perhaps more concerning, explanation. “My own theory, although I have no proof, is that China has watched Russia. When you do cyber disruption, the defenders learn your techniques and learn how to counter them – you give them insight into how you operate and how they can enhance their defenses.” China won’t do this. It is withholding its disruptive techniques “until the last moment to make sure that it can deliver a surprise.” In short, Russia uses disruptive cyber to demoralize its enemies, while China is keeping its powder dry to better destroy its enemies – if and when necessary. The future. Despite our knowledge of technology, business, and human nature, the future always surprises us. Consider 5G wireless broadband and then ponder AI. 5G is dramatically superior to 4G. It is up to 100x faster than 4G; has low latency that effectively provides real time responsiveness (think of remote surgery, AVs, critical industrial automation and smart cities); can handle up to 100x more connected devices than 4G; and is far more secure with stronger encryption and integrity protection. However, adoption of 5G is a mixed bag. It is expected to have just short of 3 billion subscribers by the end of 2025 (largely, perhaps, because it comes ready-installed in new mobile phones). But, use of its advanced features by industry is slow. Matsubara thinks there are two primary issues. The first is money. Consider a smart city. “Deploying 5G is expensive. Who is going to finance it? Central government? The individual municipality?” In both cases, that’s a levy against the taxpayer, and all politicians are wary of the effect of increasing taxes on their future political career. The same argument applies to private industry – the initial deployment cost will negatively affect short term profits and potentially upset shareholders. “Different countries have started to adopt 5G services, but much slower than we expected,” she continued, “because we’re still trying to find the use cases. It’s a sort of chicken and egg problem.” We have the technology, but do we have the will to use it? The future of AI is also deeply concerning since we simply don’t know where it is taking us. When gen-AI appeared in 2022 there was immediate concern over its effect on jobs. This concern dissipated when it became apparent that gen-AI still needed human control – the famous human in the loop. But now the fear, and reality, is returning. Matsubara compares early gen-AI to a human baby dependent on its parents. “It makes mistakes (it hallucinates and gets things wrong), and it still needs its parents to feed it (training data and algorithm design).” But this baby is growing up and is already less dependent on its parents. There is little doubt that the automation available from gen-AI is replacing humans in industry. But if we project the growing baby analogy, the worst is yet to come. Teenage years are the most rebellious and disruptive – and the teenage phase is approaching with the progression from current gen-AI (large language models or LLMs) to future artificial general intelligence (AGI). The LLM foundation model developers are working toward AGI and slowly closing in on it. AGI is artificial intelligence with cognitive reasoning similar to the thinking capability of the human brain. How that will affect both jobs and the future of humanity is an open question. “If AGI is achieved, it could replace a great deal of human manpower as AGI can process more data at scale, faster and cheaper,” suggests Matsubara. “Even today, generative AI has started to outpace the work of coders, consultants, lawyers, and doctors. This trend will accelerate in the age of AGI.” But it may not stop there. “AGI may even start to quickly ‘consider’ humans as a negative factor slowing down progress, and ‘make decisions’ to remove the humans-in-the-loop in a more aggressive manner,” she continued. It may sound like science fiction, but it is worth remembering how much science fiction has become science fact. “Quite possibly, it could endanger people’s lives for the sake of efficiency and cost control. It may choose to insert itself as a political or religious leader and make decisions ignoring the very nature of humans: our emotions and cultural contexts that are not necessarily available in data.” A big problem is that humans tend to form relationships with the AI they use. “Even today, younger people are feeling more comfortable becoming friends with generative AI, and some even want to get married to it,” she continued. And we’ve all heard of the recent cases where parents have filed lawsuits alleging chatbot participation in their children’s suicide. Asimov’s fictional first law of robotics will come to scientific life, and will require a reversal of current tendencies. “As long as humans exist, humans will have to stay in the loop to clearly define and instruct technologies about what principles must be followed.” ‘Humans in the loop’ is not an option, but a necessity if we wish to survive the rebellious period of teenage AGI. This is the work and function of a security thought leader: to understand and explain what is happening today and prepare us to manage what may be to come. Related: Google DeepMind’s New AI Agent Finds and Fixes Vulnerabilities Related: Destructive ‘PathWiper’ Targeting Ukraine’s Critical Infrastructure Related: NSA, CISA Issue Guidance on 5G Network Slicing Security Related: Cyber Insights 2025: Social Engineering Gets AI Wings

securityweek.comNov 12, 2025extracted

Data breach at Chinese infosec firm reveals cyber-weapons and target list

SYSTEMS AMD inches closer to its goal of making AI suck less ... energyHouse of Zen claims latest systems already 4x more efficient than two years ago Google pits Marvell against Broadcom as it chases AI crownAnd Marvell just offered the Chocolate Factory a $12.2B stake to sweeten the deal SYSTEMS Cerebras CS-4 rack systems juice chips for every last drop of AI performanceNext-gen systems double per-chip performance while cramming 3x as many into a rack Security Copilot tricked into telling reseachers how to hack itselfHow to social engineer an AI's reasoning engine AI and ml Payments giant Stripe is about to drop over $7 billion to become a gateway to AI token salesAI gateways look promising as companies struggle with model orchestration Security Russians are posing as Signal support to launch phishing attacksPLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more! Security Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attackPLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more Black Hat and DEF CON DEF CON Franklin project enlists hackers to harden critical infrastructureVoting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included Security EQT buys majority share in Swiss cybersecurity biz AcronisWent at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified Malware Month Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sightOn the plus side, infosec's a good bet for a long, stable career FOSS smashed one Microsoft monopoly. After 20 years of failure, it's time to smash anotherWord up GNOME can look like Windows – and Flashback can do it without extensionsNew 'Simple-taskbar' is an option, but there's a simpler, stabler way A moment of silence, please, for the final release of Debian on x86-32New Debian versions hit FOSSland in the form of 13.6 and 12.15 Baddies caught exploiting extensions bugs with perfect 10 scores on vulnerable Joomla websitesFlaws in iCagenda, Balbooa Forms extensions can impact open source CMS that powers a million sites worldwide Frame: A new X11 server – implemented directly in assemblyJoins yserver, Phoenix, and of course XLibre – and outlier Arcan Cinnamon 6.8 will support Wayland – if you want itNext version of Linux Mint’s desktop has both kinds of display server

go.theregister.comNov 9, 2025extracted

North Korean Hackers Combine BeaverTail and OtterCookie into Advanced JS Malware

The North Korean threat actor linked to the Contagious Interview campaign has been observed merging some of the functionality of two of its malware programs, indicating that the hacking group is actively refining its toolset. That's according to new findings from Cisco Talos, which said recent campaigns undertaken by the hacking group have seen the functions of BeaverTail and OtterCookie coming closer to each other more than ever, even as the latter has been fitted with a new module for keylogging and taking screenshots. The activity is attributed to a threat cluster that's tracked by the cybersecurity community under the monikers CL-STA-0240, DeceptiveDevelopment, DEV#POPPER, Famous Chollima, Gwisin Gang, PurpleBravo, Tenacious Pungsan, UNC5342, Void Dokkaebi, and WaterPlum. The development comes as Google Threat Intelligence Group (GTIG) and Mandiant revealed the threat actor's use of a stealthy technique known as EtherHiding to fetch next-stage payloads from the BNB Smart Chain (BSC) or Ethereum blockchains, essentially turning decentralized infrastructure into a resilient command-and-control (C2) server. It represents the first documented case of a nation-state actor utilizing the method that has been otherwise adopted by cybercrime groups. Contagious Interview refers to an elaborate recruitment scam that began sometime around late 2022, with the North Korean threat actors impersonating hiring organizations to target job seekers and deceiving them into installing information-stealing malware as part of a supposed technical assessment or coding task, resulting in the theft of sensitive data and cryptocurrency. In recent months, the campaign has undergone several shifts, including leveraging ClickFix social engineering techniques for delivering malware strains such as GolangGhost, PylangGhost, TsunamiKit, Tropidoor, and AkdoorTea. Central to the attacks, however, are malware families known as BeaverTail, OtterCookie, and InvisibleFerret. BeaverTail and OtterCookie are separate but complementary malware tools, with the latter first spotted in real-world attacks in September 2024. Unlike BeaverTail, which functions as an information stealer and downloader, initial interactions of OtterCookie were designed to contact a remote server and fetch commands to be executed on the compromised host. The activity detected by Cisco Talos concerns an organization headquartered in Sri Lanka. It's assessed that the company was not intentionally targeted by the threat actors, but rather they had one of their systems infected, likely after a user fell victim to a fake job offer that instructed them to install a trojanized Node.js application called Chessfi hosted on Bitbucket as part of the interview process. Interestingly, the malicious software includes a dependency via a package called "node-nvm-ssh" published to the official npm repository on August 20, 2025, by a user named "trailer." The package attracted a total of 306 downloads, before it was taken down by the npm maintainers six days later. It's also worth noting that the npm package in question is one of the 338 malicious Node.js libraries flagged earlier this week by software supply chain security company Socket as connected to the Contagious Interview campaign. The package, once installed, triggers the malicious behavior by means of a postinstall hook in its package.json file that's configured to run a custom script called "skip" so as to launch a JavaScript payload ("index.js"), which, in turn, loads another JavaScript ("file15.js") responsible for executing the final-stage malware. Further analysis of the tool used in the attack has found that "it had characteristics of BeaverTail and of OtterCookie, blurring the distinction between the two," security researchers Vanja Svajcer and Michael Kelley said, adding it incorporated a new keylogging and screenshotting module that uses legitimate npm packages like "node-global-key-listener" and "screenshot-desktop" to capture keystrokes and take screenshots, respectively, and exfiltrate the information to the C2 server. At least one version of this new module comes equipped with an auxiliary clipboard monitoring feature to siphon clipboard content. The emergence of the new version of OtterCookie paints a picture of a tool that has evolved from basic data-gathering to a modular program for data theft and remote command execution. Also present in the malware, codenamed OtterCookie v5, are functions akin to BeaverTail to enumerate browser profiles and extensions, steal data from web browsers and cryptocurrency wallets, install AnyDesk for persistent remote access, as well as download a Python backdoor referred to as InvisibleFerret. Some of the other modules present in OtterCookie are listed below - Remote shell module, which sends system information and clipboard content to the C2 server and installs the "socket.io-client" npm package to connect to a specific port on the OtterCookie C2 server and receive further commands for execution File uploading module, which systematically enumerates all drives and traverses the file system in order to find files matching certain extensions and naming patterns (e.g., metamask, bitcoin, backup, and phrase) to be uploaded to the C2 server Cryptocurrency extensions stealer module, which extracts data from cryptocurrency wallet extensions installed on Google Chrome and Brave browsers (the list of extensions targeted partially overlaps with that of BeaverTail) Furthermore, Talos said it detected a Qt-based BeaverTail artifact and a malicious Visual Studio Code extension containing BeaverTail and OtterCookie code, raising the possibility that the group may be experimenting with new methods of malware delivery. "The extension could also be a result of experimentation from another actor, possibly even a researcher, who is not associated with Famous Chollima, as this stands out from their usual TTPs," the researchers noted. Contagious Interview Evolves with New OtterCandy Malware The disclosure comes as NTT Security Holdings shared details of a new malware called OtterCandy, deployed in connection with the Contagious Interview campaign since July 2025, targeting Windows, macOS, and Linux systems. An early sample of OtterCandy was uploaded to the VirusTotal platform in February 2025. OtterCandy, per the Japanese cybersecurity company, combines the features of OtterCookie and RATatouille, a remote access trojan (RAT) distributed via the supply chain compromise of the npm package "rand-user-agent" back in May 2025. This is the first time the attack has been attributed to North Korean threat actors. The obfuscated payload embedded within the npm package is designed to set up a stealthy communication channel with a remote server and exfiltrate files within a particular directory and execute shell commands, the latter of which is specific only to Windows, according to Aikido. The full list of supported commands is below - env, to search for secret filenames across the entire file system imp, to search for secret filenames within the home directory pat, to search for filenames matching a preset pattern within the current directory upload, to transmit system information, browser passwords, wallet files, and extension data (MetaMask, Phantom, and TronLink) from Google Chrome and Edge to the C2 server exec, to cancel in-progress scans or uploads (ss_stop), upload a single file (ss_upf), recursively upload the contents of a directory (ss_upd), change current directory (cd), or terminate the malware process (ss_del) OtterCandy is said to be distributed via a sub-cluster of activity tracked as ClickFake Interview (aka Cluster B), which involves deceiving users with ClickFix-style lures to run malicious commands so as to fix supposed camera or microphone issues when job seekers attempt to provide a video assessment on a fake website under their control. "OtterCandy is a RAT and Info Stealer implemented by Node.js," NTT Security said. "It is malware that combines elements of RATatouille and OtterCookie. OtterCandy accepts commands when connected to the C2 server via Socket.IO." The first-stage malware used to deliver OtterCandy is named DiggingBeaver, a JavaScript payload that's executed once the victim copies and runs the command via the Windows Run dialog. DiggingBeaver has also been found to distribute other known ClickFake Interview malware, such as GolangGhost and FROSTYFERRET. NTT Security said it also observed a new variant of OtterCandy (OtterCandy v2) in August 2025 that comes with expanded functionality to harvest data from three additional cryptocurrency wallet extensions (Suiet, Trust Wallet, and Rabby Wallet), as well as enhance the "ss_del" command to delete Windows Registry keys and erase files and directories. (The story was updated after publication on October 19, 2025, to include details of OtterCandy malware from NTT Security Holdings.)

thehackernews.comOct 17, 2025extracted

Week in review: 2 threat actors exploiting WinRAR 0-day, Microsoft fixes “BadSuccessor” Kerberos flaw

Week in review: 2 threat actors exploiting WinRAR 0-day, Microsoft fixes “BadSuccessor” Kerberos flaw Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: WinRAR zero-day was exploited by two threat actors (CVE-2025-8088) The RomCom attackers aren’t the only ones that have been leveraging the newly unveiled WinRAR vulnerability (CVE-2025-8088) in zero-day attacks: according to Russian cybersecurity company BI.ZONE, a group tracked as Paper Werewolf has been using it to target Russian organizations. Microsoft fixes “BadSuccessor” Kerberos vulnerability (CVE-2025-53779) For August 2025 Patch Tuesday, Microsoft has released security updates resolving 100+ security vulnerabilities in its various solutions, including a relative path traversal flaw in Windows Kerberos (CVE-2025-53779) that allows an authorized attacker to elevate privileges over a network as part of a BadSuccessor attack. AWS CISO explains how cloud-native security scales with your business In this Help Net Security interview, Amy Herzog, CISO at AWS, discusses how cloud-native security enables scalable, flexible protection that aligns with how teams build in the cloud. Vulnerabilities in MSP-friendly RMM solution exploited in the wild (CVE-2025-8875, CVE-2025-8876) Two vulnerabilities (CVE-2025-8875, CVE-2025-8876) in N-central, a remote monitoring and management (RMM) solution by N-able that’s popular with managed service providers, are being exploited by attackers. From legacy to SaaS: Why complexity is the enemy of enterprise security In this Help Net Security interview, Robert Buljevic, Technology Consultant at Bridge IT, discusses how the coexistence of legacy systems and SaaS applications is changing the way organizations approach security. Croatian research institute confirms ransomware attack via ToolShell vulnerabilities The Ruđer Bošković Institute (RBI), the largest Croatian science and technology research institute, has confirmed that it was the one of “at least 9,000 institutions worldwide” that were attacked using the Microsoft SharePoint “ToolShell” vulnerabilities. How military leadership prepares veterans for cybersecurity success In this Help Net Security interview, Warren O’Driscoll, Head of Security Practice at NTT DATA UK and Ireland, discusses how military leadership training equips veterans with the mindset, resilience, and strategic thinking needed to excel in cybersecurity. Open-source flow monitoring with SENSOR: Benefits and trade-offs Flow monitoring tools are useful for tracking traffic patterns, planning capacity, and spotting threats. But many off-the-shelf solutions come with steep licensing costs and hardware demands, especially if you want to process every packet. Brute-force attacks hammer Fortinet devices worldwide A surge in brute-force attempts targeting Fortinet SSL VPNs that was spotted earlier this month could be a portent of imminent attacks leveraging currently undisclosed (potentially zero-day) vulnerabilities in Fortinet devices. Fortinet warns about FortiSIEM vulnerability with in-the-wild exploit code (CVE-2025-25256) Fortinet has released patches for a critical OS command injection vulnerability (CVE-2025-25256) in FortiSIEM, after practical exploit code surfaced in the wild. APT groups are getting personal, and CISOs should be concerned Instead of focusing only on corporate systems, some APT groups are now going after executives in their personal lives. Home networks, private devices, and even family members have become targets. Netscaler vulnerability was exploited as zero-day for nearly two months (CVE-2025-6543) FortiGuard Labs has reported a dramatic spike in exploitation attempts targeting CitrixBleed 2, a critical buffer over‑read flaw (CVE‑2025‑5777) affecting Citrix NetScaler ADC (Application Delivery Controller) and Gateway devices. AI security governance converts disorder into deliberate innovation AI influences more than just technology, encompassing hiring practices, policy choices, ethical standards, brand positioning, and leadership strategy. That’s why governance needs to span functions and bring together varied stakeholders. Win-DDoS: Attackers can turn public domain controllers into DDoS agents SafeBreach researchers have released details on several vulnerabilities that could be exploited by attackers to crash Windows Active Directory domain controllers (DCs), one one of which (CVE-2025-32724) can also be leveraged to force public DCs to participate in distributed denial-of-service (DDoS) attacks. How Brandolini’s law informs our everyday infosec reality Brandolini’s law casts a long shadow over everything we do, from fighting social engineering to dissecting threat intel and even trying to make sense of the very tools we rely on. Pentesting is now central to CISO strategy Security leaders are rethinking their approach to cybersecurity as digital supply chains expand and generative AI becomes embedded in critical systems. What makes a security program mature and how to get there faster Security leaders are flush with tools and data, but it’s not helping their programs mature. In this Help Net Security video, PlexTrac’s Dan DeCloss outlines the 3 key gaps holding security programs back and what sets mature programs apart. NIST finalizes lightweight cryptography standard for small devices The National Institute of Standards and Technology (NIST) has finalized a lightweight cryptography standard to protect even the smallest networked devices from cyberattacks. Why DNS threats should be on every CISO’s radar in 2025 DNS is once again in the crosshairs of threat actors. According to the 2025 DNS Threat Landscape Report by Infoblox, attackers are changing tactics, and enterprises are feeling the pressure. Breaches are up, budgets are too, so why isn’t healthcare safer? A new report from Resilience outlines a growing cyber crisis in the U.S. healthcare sector, where ransomware attacks, vendor compromise, and human error continue to cause widespread disruption. Fighting fraud with AI: The new identity security playbook In this Help Net Security video, Hal Lonas, CTO at Trulioo, talks about the rise of synthetic identity fraud and how it’s quickly becoming one of the biggest threats in financial crime. EntraGoat: Vulnerable Microsoft Entra ID infrastructure to simulate identity security misconfigurations EntraGoat is a purpose-built tool that sets up a vulnerable Microsoft Entra ID environment to mimic real-world identity security issues. Free courses: Master AI tools from Microsoft, AWS, and Google Learn how AI technologies can be applied to enhance security, create safe and responsible applications, develop intelligent agents, and improve information discovery. Cybersecurity jobs available right now: August 12, 2025 We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now. Product showcase: Apricorn Aegis NVX, a high-security, portable SSD The Apricorn Aegis NVX is a hardware-based 256-Bit AES XTS external SSD drive with integrated USB-C cable. Its storage capacities range from 500GB to 2TB. The device is OS free and cross-platform compatible. New infosec products of the week: August 15, 2025 Here’s a look at the most interesting products from the past week, featuring releases from Brivo, Envoy, Prove, Rubrik, and Trellix.

helpnetsecurity.comAug 17, 2025extracted

How military leadership prepares veterans for cybersecurity success

How military leadership prepares veterans for cybersecurity success In this Help Net Security interview, Warren O’Driscoll, Head of Security Practice at NTT DATA UK and Ireland, discusses how military leadership training equips veterans with the mindset, resilience, and strategic thinking needed to excel in cybersecurity. Drawing on habits such as disciplined preparation, blunt honesty, and adaptive decision-making, veterans bring a blend of defensive and offensive planning skills to high-stakes cyber operations. Their leadership experience fosters trust, cohesion, and problem-solving, qualities that can transform cybersecurity teams. Can you walk us through how military leadership training shapes the mindset of veterans entering cybersecurity? What kinds of habits or values translate most directly into elite cyber performance? So many ways! For a start, military leadership training instills a mindset focused on honesty and integrity, with a focus on objectives, logical decision-making, contingency planning and adaptability under pressure. Military personnel are trained to operate under both physical and mental stress, planning carefully for all eventualities within an ‘if this, then that’ framework. This aligns with cybersecurity’s emphasis on logical control planning and structured incident response. What’s more, soldiers’ training equips people with both the defensive planning skills to operate in high-threat environments, and the offensive planning capabilities required for mission targeting. These are advanced skills. War-fighting is not linear but asymmetric and complex, with a mix of misinformation and hard and soft power plays. In many parts of the business world, these skills look out of place. But in cybersecurity, where subject matter experts must constantly think about the adversary’s position, and how offensive and defensive activities shape control planning, they are extremely valuable. Every soldier, regardless of role or function, comes with a pre-programmed security mindset, instantly differentiating their thinking from that of their civilian peers. Dozens of military practices and tools are directly transferable into industry-based cybersecurity, teaching quick but confident decision-making paired with communication up and down the chain. Military life also instills a practice of arduous training that pays off in civilian life. In an environment where mistakes can easily cost lives, the armed forces are drilled in the need to practice skills until people’s responses are entirely automatic, giving them the mental capacity to think carefully while muscle memory takes care of essential and urgent tasks. These practices build enormous resilience and mental toughness, enabling veterans to pivot swiftly when under pressure while retaining their focus on delivering the mission. Such habits are often critical for the rapid response and recovery needed within cybersecurity environments. Ultimately, the military drives a range of behaviors and thinking that, when enabled correctly, can significantly enhance organizations’ ability to deliver cybersecurity strategies and operations. These include the abilities to put your team first rather than yourself, to plan and train for the unexpected, to act with moral courage, honesty, and integrity, to shape decision-making around a realistic assessment of the opponent’s behavior, to deliver direct, to-the-point communications, to retain mental flexibility and resilience, and always to focus on delivering the mission. Cybersecurity often involves high-stakes, high-pressure situations. How does veterans’ experience in critical missions prepare them for these moments? Can you share a time when that resilience made a difference? After dealing with extremely high-pressure environments, in which making the wrong decision can cost lives, veterans and reservists have little trouble dealing with the kinds of risks found in the world of business, such as threats to revenue, brand value and jobs. What’s more, the time-critical mission mindset so essential within the military is highly relevant within cybersecurity, where attacks and breaches must be dealt with confidently, rapidly and calmly. In the armed forces, people often find themselves in situations so intense that Maslow’s hierarchy of needs is flipped on its head. You’re not aiming for self-actualization or more advanced goals, but simply trying to keep the team alive and maintain essential operations. This ingrained focus on the fundamentals helps veterans to cut through the noise, think clearly, and take decisive and, when required, difficult decisions in high-pressure environments. This is valuable in the world of cybersecurity. I remember one occasion on which a critical national infrastructure (CNI) client asked us to stand up a Security Operations Centre to address an emergency. This would normally take weeks or months, yet the military mindset made it possible to get it up and running 24/7 within a few days. In high-stakes, time-critical environments, veterans thrive, making the impossible possible. How do veterans’ trust-building instincts and ability to foster strong team cohesion show up in cybersecurity teams or client-facing roles? Any stories that illustrate how they built or stabilized a team quickly? Research shows that high-performance teams are often built around the ability to table, discuss and address the unmentionable, yet in my experience, many people in business don’t know how to have difficult conversations. This is a fundamental failing, for a lack of openness and honesty foments distrust and weakens teams’ ability to realize their goals. Military experience, on the other hand, fosters unparalleled trust, honesty and integrity within teams. Armed forces personnel must communicate really difficult messages. Telling people that many of them may die within hours demands a harsh honesty, but it builds trust. Combine this with an ability to achieve shared goals, and military leaders inspire others to follow them regardless of the obstacles. So veterans bring blunt honesty, communication, and a mission focus to do what is needed to succeed. These are all characteristics that are essential in cybersecurity, where you have to call out critical risks that others might avoid discussing. Veterans’ ability to provide a vision and lead from the front are another factor that enables teams to rapidly stabilize and succeed against tight deadlines, and this applies to experienced soldiers of all ranks. While people often assume that the military is intensely hierarchical, western forces favour a principle of local command. Those on the battleground are recognized to have greater situational awareness than distant officers, and are given the autonomy to make decisions and adjust tactics in-line with their operating procedures. You can’t micromanage people on the battlefield. Instead, personnel are empowered to act for themselves within the limits set by intense training and boundaries. These too are extremely valuable behaviors in staff combating cyber crime and attacks, enabling them to respond rapidly as threats evolve. Clients often mention how refreshing it is to have someone come in and tell them the blunt truth, even when that truth may not be in our immediate interest. If they don’t actually need the latest equipment and their current kit is good enough, for example, I’ll say so. From your experience, what kind of military roles or training most directly align with cybersecurity functions today? Any unexpected overlaps? Roles in targeting and reconnaissance align surprisingly well with cybersecurity. People develop a threat-based mindset given experience in these fields, enabling them not only to identify and disrupt targets but also to understand how they themselves might be targeted. That dual perspective is invaluable in cyber threat intelligence, where anticipating an adversary’s next move is critical to staying one step ahead. Communication roles such as those in Royal Signals also offer helpful overlaps, providing experience in command, control and managing information flow under pressure. These backgrounds foster critical thinking, rapid decision-making, and resilience that are invaluable in cyber operations, even if the specific technical knowledge must be learned after transitioning. Have you seen specific examples of onboarding or mentorship practices that helped veterans overcome those gaps? What made them effective? Veterans come into the cybersecurity industry with strong ‘hardware’, resilience, leadership and logical thinking, for example, but often need to develop ‘software’ skills, such as specific cybersecurity knowledge, business experience, and familiarity with software. Effective onboarding focuses on leveraging their innate strengths while rapidly building technical competence through tailored training and mentorship. This can take a little while, and military personnel generally enjoy a good challenge! The key to success here is recognizing and addressing knowledge gaps early, openly and without stigma, creating an environment where veterans can blend their military strengths with industry expertise. It also helps to have veterans involved in the design and delivery of onboarding processes, so newcomers can engage first with people who understand their background and challenges, including mental health considerations. Organizations that recognize the value of military skills in cybersecurity can benefit enormously from recruiting veterans and reservists, but it does require careful thought, suitable policies and a commitment to personnel development. Signing up to the Armed Forces Covenant is one valuable way in which employers can improve their ability to recruit and support military personnel.

helpnetsecurity.comAug 15, 2025extracted