Intelligence Feed

1w ago · bleeping-computer

The DeadLock ransomware operation, active since mid-2025, employs double-extortion tactics by stealing and encrypting data to extort ransom payments. It uses blockchain infrastructure, specifically the Polygon blockchain, to store configuration data and leak site content, making takedown efforts more difficult. The ransomware communicates with victims via a decentralized Session network and hosts stolen data on Wasabi cloud, while using XChaCha20 encryption with Curve25519 key exchange to lock files, appending the '.dlock' extension and dropping ransom notes. Microsoft observed deployment by multiple threat groups, including affiliates linked to Lynx and INC ransomware ecosystems.

1w ago · unit42

Unit42 identified a new version (v7) of the Kimwolf Android/IoT botnet, which enhances DDoS capabilities and strengthens command-and-control (C2) resilience. The malware targets Android TV boxes and IoT devices via unsecured ADB ports, using HTTP/2-based DDoS floods that spoof browser fingerprints to mimic legitimate traffic. Its C2 infrastructure leverages Ethereum Name Service (ENS) resolution via public RPC endpoints, a suspected operator-controlled RPC facade, and a fallback to a hard-coded Tor .onion address, ensuring persistence against takedown attempts.

1w ago · hacker-news

The DeadLock ransomware group has adopted a resilient, decentralized infrastructure leveraging Polygon blockchain smart contracts to manage victim communications and data leak operations, making takedown efforts more difficult. The ransomware encrypts files with the '.dlock' extension, uses hybrid encryption (Curve25519 and XChaCha20), and drops an HTML-based interactive recovery note (RECOVERY_CHAT.<UID>.html) that enables end-to-end encrypted chat and access to a blockchain-hosted data leak blog. The HTML note retrieves proxy server addresses via JavaScript interacting with Polygon smart contracts, allowing for censorship-resistant communication. The attackers also use geofencing to avoid certain regions, employ resource throttling, erase logs, and leverage AnyDesk for remote access.

1w ago · hacker-news

Zoom addressed three critical vulnerabilities in its annotation feature that could allow a meeting participant to hijack another attendee's client without any user interaction. The flaws include a buffer overflow (CVE-2026-53413), a buffer over-read (CVE-2026-53414), and a use-after-free (CVE-2026-53415), all of which could be exploited remotely in a zero-click scenario. The vulnerabilities affect multiple Zoom clients and were patched in versions released in June and July 2026, though no exploitation has been observed in the wild. The research was conducted by A Security, which demonstrated rapid exploit development using publicly available AI models.

1w ago · hacker-news

Palo Alto Networks Unit 42 discovered a new version of the Kimwolf/AISURU Android and IoT botnet, dubbed Kimwolf v7, in February 2026. This version enhances operational resilience by using HTTP/2-based DDoS floods that mimic legitimate browsing through complete browser fingerprints, making detection more difficult. It employs a tiered C2 infrastructure leveraging Ethereum Name Service (ENS), a hard-coded Tor .onion address, and a local proxy for traffic routing, while offloading initial access to external loaders and focusing on DDoS and proxy relay functions.

1w ago · hacker-news

Microsoft's August 2026 security update addresses 398 vulnerabilities, including CVE-2026-68820, a Windows kernel driver zero-day under active exploitation for privilege escalation. The flaw exists in afd.sys and allows attackers with initial code execution to escalate to SYSTEM privileges. Check Point Research attributes the exploitation to the Lazarus Group in their 'Operation Dream Job' campaign. Four additional critical unauthenticated remote code execution flaws in Windows DNS Server, Windows Deployment Services, Microsoft QUIC, and HPC Pack are also patched but were not under active attack at release. The update also completes a SharePoint exploit chain by fixing CVE-2026-63520, the RCE component that, when combined with July's authentication bypass (CVE-2026-55040), enabled unauthenticated RCE.

1w ago · bleeping-computer

Cisco has warned of active exploitation of a high-severity denial-of-service vulnerability, CVE-2026-20349, in its Secure Firewall ASA and Threat Defense (FTD) software. The flaw stems from insufficient error checking when processing HTTP requests, allowing an unauthenticated remote attacker to crash affected devices by sending a crafted HTTP request to the SSL VPN service. Exploitation leads to a reload of the device, causing a DoS condition, and no workarounds exist—only patching with fixed software releases mitigates the issue.

1w ago · hacker-news

Researchers at Rapid7 discovered an exploit chain enabling unauthenticated remote code execution (RCE) on on-premises Microsoft SharePoint servers. The chain begins with CVE-2026-55040, a vulnerability in SharePoint's JWT validation pipeline that allows an unauthenticated attacker to impersonate any user given their SID or UPN. This is combined with CVE-2026-63520, an unsafe .NET type instantiation in Business Connectivity Services, to achieve RCE as the server's Windows service account. The attack affects SharePoint Server Subscription Edition, 2019, and 2016, as well as Project Server 2013 SP1 and Office Web Apps 2013 SP1. The July 2026 updates reportedly break the exploit chain, though the August patch containing the fix had not yet been publicly released at the time of disclosure.

1w ago · hacker-news

Russian nation-state threat actor UAC-0145, linked to Sandworm (APT44), is conducting a social engineering campaign targeting Ukrainian IT workers through fake job interviews. The attackers pose as recruiters from legitimate IT companies and lure victims into installing a malicious custom VPN client called SopraVPN, hosted on SourceForge. The backdoored WireGuard-based client allows attackers to execute arbitrary PowerShell commands on compromised systems by decrypting malicious scripts using modified configuration files. The malware also establishes persistence via scheduled tasks on Windows or cURL downloads on Linux to retrieve secondary payloads.

1w ago · bleeping-computer

Microsoft's August 2026 Patch Tuesday addresses 400 vulnerabilities, including three zero-days. One of these, CVE-2026-68820, was actively exploited in the wild by the North Korean threat actor Lazarus Group to elevate privileges and deploy a kernel-mode rootkit called FudModule. The other two zero-days, CVE-2026-62832 and CVE-2026-72971, were publicly disclosed but not confirmed as exploited. Check Point linked the exploitation of CVE-2026-68820 to Lazarus, highlighting ongoing targeting using local privilege escalation in Windows drivers.

1w ago · bleeping-computer

Delta Air Lines investigated a Wi-Fi deauthentication attack that occurred on Flight 591 from Las Vegas to Atlanta, carrying attendees of the DEF CON 34 hacker conference. Passengers allegedly performed a deauth attack to disconnect others from the in-flight network and broadcast a rogue Wi-Fi access point named 'Delta WiFi Fast' to phish credentials. The cabin crew deactivated Wi-Fi for about 30 minutes, and upon landing, federal authorities boarded the aircraft to question suspects and seize hardware. The rogue network reportedly displayed a phishing page harvesting personal and Google login credentials.

1w ago · hacker-news

Gunra ransomware, a Conti-derived operation, has been actively targeting critical infrastructure sectors globally, including healthcare, financial services, and government facilities. The group exploits known vulnerabilities in Fortinet (CVE-2025-24472) and Schneider Electric (CVE-2024-5559) devices to gain initial access, then uses Impacket tools for lateral movement and credential dumping. Gunra employs a double extortion model, exfiltrating data before encryption, and has listed 51 victims on its leak site since April 2025, primarily in South Korea, Brazil, and Europe. The group has ties to affiliate programs, uses WhatsApp for negotiations, and has demonstrated advanced capabilities such as MFA bypass and session hijacking via SSL-VPN manipulation.

1w ago · bleeping-computer

Wesco confirmed a cybersecurity incident involving its cloud CRM environment after the data extortion group ExfilSquad claimed to have stolen and leaked 2.6 million records containing customer and employee PII, CRM data, and authentication metadata. The company stated it does not believe sensitive data is at risk and reported no ransomware or malicious software found in its systems. ExfilSquad, known for targeting improperly configured Microsoft Power Pages, published the data after Wesco did not meet a ransom deadline. Researchers link the group's past activity to misconfigured Microsoft Dynamics 365 instances.

1w ago · securelist

Project CAV3RN is a modular espionage framework targeting entities in Israel, continuing to evolve with sophisticated command-and-control (C2) capabilities. The framework uses a multi-transport C2 module that leverages DNS A-record responses to dynamically select between direct HTTPS connections and Google Apps Script relays for C2 communications. It employs DNS-based channel selection and can rotate Google Apps Script deployment IDs via DNS queries, enhancing resilience and evasion. The infrastructure includes a local DLL broker for component orchestration and runtime upgrades, indicating a high level of operational maturity.

1w ago · hacker-news

Researchers from the University of Birmingham and Fuzzware discovered that malicious SIM cards can exploit the RUN AT proactive command to execute attacker-controlled code on vulnerable cellular IoT devices. The attack affects devices using certain Quectel modules and select smartphones like the OPPO Reno 14 F 5G and ASUS Zenfone 9, all running Qualcomm communication processors. By issuing AT commands through a hostile SIM, attackers can achieve code execution, downgrade network connections to insecure 2G, or exfiltrate files via TFTP and SMTP. A specific vulnerability in the Quectel EC25AFXDGA module's atfwd_daemon enables remote code execution due to an unsafe format string and insufficient character filtering. The issue has been disclosed to vendors, but no public advisories or patches are widely available yet.

1w ago · bleeping-computer

Cisco has warned of two high-severity vulnerabilities in ClamAV, tracked as CVE-2026-20337 and CVE-2026-20338, affecting versions 1.5.0 through 1.5.3. These flaws reside in the ZIP archive parser and stem from improper boundary checks and memory handling, allowing unauthenticated remote attackers to cause a denial-of-service (DoS) condition by submitting a specially crafted ZIP file that crashes the ClamAV scanning process. Proof-of-concept exploit code is publicly available, though there is no evidence of active exploitation in the wild. The vulnerabilities have a high security impact on Windows platforms due to the privileged context in which ClamAV runs, and they were patched in ClamAV version 1.5.4 released on August 7, 2026.

1w ago · bleeping-computer

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that ransomware gangs are actively exploiting a high-severity remote code execution vulnerability, CVE-2026-45659, in Microsoft SharePoint. The flaw stems from deserialization of untrusted data, allowing low-privileged attackers to execute arbitrary code on unpatched servers with low attack complexity. CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on July 1, mandating federal agencies to patch within three days, and warned that over 200 internet-exposed SharePoint servers remain unpatched despite available updates.

1w ago · hacker-news

Researchers Alejandro Hernando and Borja Martinez demonstrated a privilege escalation technique called 'Plug And Pwn' that abuses Windows Plug and Play (PnP) auto-install functionality to achieve SYSTEM-level code execution on fully updated Windows 11 systems. The attack chain involves emulating a Sierra Wireless USB device to trigger installation of SwiService.exe, a SYSTEM service used to manipulate DNS settings, followed by emulating a Sony FeliCa reader that downloads configuration over HTTP, enabling a path-traversal vulnerability to drop a malicious DLL into System32. Reconnecting the Sierra device loads the DLL via a privileged service, resulting in SYSTEM compromise. A remote variant using RDP with USB redirection enabled abuses a similar path via Intel RealSense software and a CRYPTBASE.dll search-order hijacking from a user-writable directory.

1w ago · bleeping-computer

US and South Korean agencies issued a joint advisory warning of Gunra ransomware attacks targeting government and critical infrastructure organizations. The ransomware, first observed in April 2025, is derived from the leaked Conti source code and uses double extortion tactics. Gunra actors exploit vulnerabilities in Fortinet devices (CVE-2024-55591, CVE-2025-24472) and misconfigured SSH access on internet-facing systems to gain initial access, and have expanded operations through a ransomware-as-a-service (RaaS) model under the alias 'Golden Community'. The group has also recruited initial access brokers, including penetration testers, and has extended attacks to Linux environments since mid-2025.

1w ago · hacker-news

In December 2025, attackers breached a Polish combined heat and power (CHP) plant by exploiting a private cellular network (APN) used by the grid operator. The intrusion originated from a compromised wind farm's FortiGate firewall, which had internet-exposed VPN services without multi-factor authentication. From there, attackers pivoted via SSH tunneling through a Teltonika RUTX50 router to access a WAGO PFC200 controller with default credentials, ultimately gaining control of Siemens PLCs and shutting down critical systems including a steam turbine and water treatment. No malware was used; destructive actions were carried out using legitimate device functions. The attack highlights risks in misconfigured private APNs and poor credential hygiene in operational technology environments.

1w ago · hacker-news

A supply chain attack on WordPress plugins distributed by BdThemes exploited a cross-site scripting (XSS) vulnerability in a remote JSON data stream used by the 'Biggopti' component. Attackers compromised a DigitalOcean Spaces bucket to inject malicious JavaScript payloads that execute in the browser of logged-in administrators, creating rogue admin accounts and deploying a PHP web shell. The attack does not modify plugin source code but instead poisons JSON responses, enabling silent exploitation on every wp-admin page load. Two payloads were identified: one retrieves targeting instructions from a C2 server, while the other generates deterministic credentials based on the victim's hostname, allowing attackers to access compromised sites without centralized credential storage.

1w ago · bleeping-computer

In December 2025, a threat actor linked to the Russian Electrum group breached a small Polish combined heat-and-power (CHP) plant by exploiting a misconfigured private Access Point Name (APN) network. The attackers gained initial access through a compromised FortiGate firewall and Teltonika cellular router at a wind farm, then moved laterally through the private APN to reach the CHP plant's operational technology (OT) network. They exploited default credentials on a WAGO PFC200 PLC, used it as a bridge to access Siemens PLCs, and ultimately shut down critical systems including the steam turbine and water treatment system.

1w ago · bleeping-computer

A supply-chain attack on BdThemes, a developer of premium WordPress plugins, allowed a threat actor to compromise its infrastructure and inject malicious JavaScript into a remote JSON feed used by its plugins. This feed is loaded in the WordPress admin dashboard, where the attacker exploited a cross-site scripting (XSS) vulnerability in the Biggop Library to create rogue administrator accounts on affected sites. The attack was stealthy, required no user interaction, and used a webshell for persistence. The same actor is believed to be behind recent similar attacks on other WordPress plugins.

1w ago · bleeping-computer

Valve notified European Steam hardware customers of a data breach resulting from a cyberattack on its shipping partner, CEVA Logistics, between July 29 and August 1, 2026. Attackers accessed CEVA's systems and likely exfiltrated customer data including names, addresses, phone numbers, email addresses, and details of hardware orders. Valve confirmed that no Steam account credentials, payment information, or other sensitive account data were exposed. The company warned customers about potential phishing attempts leveraging the stolen personal information.

1w ago · hacker-news

A zero-day vulnerability in Metabase, a business intelligence platform, is being exploited in the wild, allowing unauthenticated remote attackers to perform SQL injection and gain full administrator access to affected instances. This enables attackers to steal database credentials, exfiltrate data, and modify configurations. The vulnerability has a CVSS score of 10.0 but lacks a CVE identifier. One confirmed victim is Framework. Additionally, Chinese-made Zbtlink routers were found shipping with a factory-installed backdoor that phones home to Chinese C2 servers every 35 seconds, affecting at least 20 models. The backdoor enables remote command execution. Separately, the threat actor UNC6671 is conducting vishing attacks against financial firms, using voice phishing to capture credentials and MFA tokens via adversary-in-the-middle infrastructure, then deploying scripts for data exfiltration from cloud environments.

1w ago · hacker-news

Storm-1175, a China-linked financially motivated threat actor, has deployed a new ransomware named StormEncryptor, written in C++, which appends the '.encrypted' extension to encrypted files and drops a ransom note titled '!!!README_FIRST!!!.txt'. The group likely gained initial access by exploiting CVE-2026-18577, a patch bypass vulnerability in N-able N-central, which allows authentication bypass and account takeover. Storm-1175 has a history of exploiting vulnerabilities in internet-facing systems, rapidly moving from initial access to data exfiltration and ransomware deployment within days, using tools like AnyDesk, SimpleHelp, Advanced IP Scanner, and Mimikatz for credential dumping.

1w ago · bleeping-computer

A China-based threat actor tracked as Storm-1175, previously associated with the Medusa ransomware operation, has shifted to using a new ransomware variant called StormEncryptor. The actor exploits a vulnerability in the N-central RMM tool (CVE-2026-18577) to gain initial access, then uses tools like AnyDesk, SimpleHelp, Advanced IP Scanner, and Mimikatz for lateral movement and credential dumping. StormEncryptor is written in C++, encrypts files appending the '.encrypted' extension, and drops a ransom note titled '!!!README_FIRST!!!.txt', threatening data leakage if payment is not negotiated within three days.

1w ago · bleeping-computer

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that ransomware gangs are actively exploiting two recently patched vulnerabilities in SonicWall SMA1000 appliances, tracked as CVE-2026-15409 and CVE-2026-15410. These flaws, including a critical server-side request forgery (SSRF) vulnerability, were exploited in zero-day attacks as early as June 22, prior to public disclosure. A threat actor known as UTA0533 has been linked to the exploitation of these vulnerabilities to deploy custom malware such as KNUCKLEBALL, Sou5, ROOTRUN, and ORANGETAIL on vulnerable systems. CISA added the vulnerabilities to its Known Exploited Vulnerabilities catalog, mandating federal agencies to patch within three days.

1w ago · wiz

A zero-day SQL injection vulnerability in Metabase, tracked as GHSA-vwf4-m7j8-wcjf, has been exploited in the wild against Metabase Cloud and potentially self-hosted instances. The vulnerability exists in versions 1.58 and later, where an attacker can inject malicious SQL by including a 'user-id' parameter with a 'raw' SQL payload in the /api/session/reset_password endpoint. The flaw stems from improper handling of JSON input, merging of unvalidated user input, and unsafe use of HoneySQL's :raw directive, leading to arbitrary blind SQL injection. Wiz Research reverse-engineered the vulnerability after the patch was not publicly disclosed, and observed public proof-of-concept exploits as of August 10, 2026.

1w ago · hacker-news

Kimsuky, a North Korean state-sponsored threat actor, is building an offline AI stack to enhance its phishing operations and automate malware development. The group has been observed deploying tools like Ollama, GPT4All, and Msty on its own infrastructure, with evidence of configured local document databases (localdocs_v3.db) indicating use of retrieval-augmented generation (RAG) for intelligence analysis. Additional tools such as LLaMaSharp, Microsoft Semantic Kernel, Whisper, and Cursor suggest efforts to integrate AI into custom malware development and speech-to-text processing. This activity supports the ongoing Operation GitPower, which abuses GitHub repositories as command-and-control channels and delivers AsyncRAT payloads.