cyber.hendryadrian.com is a cybersecurity news and threat intelligence aggregation platform. It collects external cybersecurity reporting and turns it into structured information that is easier to search, correlate, and explore.
Analysis traces a signed funding-form decoy through DLL side-loading to an unattributed plugin-based RAT. Sandbox traffic showed an operator viewing the screen and browsing files; the article also details persistence and defensive hunting advice.
FortiGuard Labs attributes a South Asia-focused campaign to suspected BITTER with high confidence. Three Windows infection chains use LNK, URL and VHDX lures to deploy PapRAT; a Rust variant adds commands and HTTPS C2.
Microsoft investigated two intrusions that began with attackers posing as IT support on Teams and abusing insecure AD CS configurations. In one, company data was copied to an external server; the amount was not disclosed.
Node.js October 2026 updates fix 10 flaws across 22.x, 24.x and 26.x, including the actively exploited critical Node2Shell Brotli flaw and DNS/TLS validation bugs. The update also removes trust in eight compromised eMudhra intermediate CA certificates.
Defused Cyber reports in-the-wild attempts to exploit CVE-2026-81648, an unauthenticated flaw in CryptoPayment Gateway for WordPress that can expose wallet credentials. No fix is available; site owners are advised to remove the plugin and rotate wallet keys.
VulnCheck observed attempts to exploit CVE-2026-58115 on Siemens SIMATIC IoT2050 Advanced devices, deploying Linux payloads and Node-RED command backdoors. Siemens fixed the flaw in version 4.3.4.1 or later.
A practical guide to identifying DKIM replay attacks, distinguishing them from relays and spoofing, and responding with DMARC enforcement, message-level evidence, old-key removal, and Amazon SES monitoring.
A SOC Prime guide gives API and CLI export routes for major SIEMs, recommends narrow time windows and raw events, and explains permission, time-zone and retention limits. It also promotes LogTotal for file-based analysis.
A practical guide to granting read and export access to Windows event logs without local admin rights, checking channel permissions, enabling remote access, and troubleshooting common access and forwarding issues.
Microsoft analyzes 2,056 CVEs exploited in the wild through September 2026, finding exploitation concentrated in takeover vulnerabilities and outpacing patching. It recommends prioritizing high-impact flaws on exposed, critical assets.
A Broadcom-commissioned Q3 2026 Forrester Consulting survey of 253 cybersecurity decision-makers found midmarket teams face resource constraints and tool sprawl; 64% had implemented XDR, and most adopters reported or anticipated faster response and better root-cause فهم
Cloudflare reported 18.2 million network-layer DDoS attacks in Q3 2026, up from 13.2 million in Q2. Short-burst attacks surged 208%, while attacks exceeding 1 Tbps fell 69%.
Synology says ransomware actors are exploiting a flaw patched in December 2024 to target NAS devices running outdated DSM. The company urges users to update; customers have reported C3RB3R ransomware infections.
After Mercado Bitcoin reported a November 2 hack draining an estimated $49 million across 17 blockchains, Chainalysis says its coordination with law enforcement and issuers helped freeze nearly $10 million, including over $9 million in USDT.
The FBI attributed a $6.43 billion Binance cryptocurrency theft to North Korean group TraderTraitor. The article says $2.85 billion was frozen on-chain and also lists numerous CVEs, including a pre-authenticated RCE in TightVNC.
More than 100 European stores reported refrigeration disruptions resembling attacks in France earlier in October. Retailers blamed a cyberattack, but investigators have not linked the waves; internet-exposed controllers and food losses were reported.
Attackers remotely altered supermarket refrigeration controls in Belgium, Sweden, Estonia and elsewhere, causing some food losses. Outdated software and insecure connections were cited; no actor or link to the earlier French attacks was confirmed.
Stores in six European countries reported attacks that allegedly raised refrigeration temperatures and spoiled food. Danfoss StoreView controllers may be involved, but the link is unconfirmed; Censys also reports global exposure and patching figures.
Eclipse's leak site claims to hold 832 GB of Taiwan Otsuka Pharmaceutical data and shows a publication countdown. The claim, data volume and contents have not been independently verified.
Ransomware group N0n claims it compromised managed IT provider Chibitek and exposed client financial records, network credentials, configuration secrets, and internal documents. The claim is unverified.
Ransomware.live reports that actor N0n listed a Michigan cannabis operator as a victim and claims company data will be published on October 13. The claims are unverified.
Gen Threat Labs describes “BillBait,” misleading mobile subscriptions that use SMS-code autofill to make recurring-payment authorization resemble routine phone verification, and recommends reading the full SMS before submitting a code.
Censys reports that more than 11 million PHP services moved to fixed versions after PHP2Shell patches became available, while over 30 million still reported affected versions as of October 29. Its research also found that the oldest enterprise software changes little.
SOC Prime’s LogTotal analyzes EVTX, JSON/JSONL, syslog-style text and CSV logs. The guide explains which formats are sanitized, how to convert files, and how to handle encoding, timestamps and file size.
