cyber.hendryadrian.com is a cybersecurity news and threat intelligence aggregation platform. It collects external cybersecurity reporting and turns it into structured information that is easier to search, correlate, and explore.
Researchers analyzed BeCtrl, a backdoor delivered through trojanized PDFgear, Greenshot, and Snoop applications. It uses DLL sideloading, persists via registry entries or scheduled tasks, and supports remote commands and file uploads; observed C2 sessions received no.
Enea says the SilentAir group used compromised equipment at Asian mobile operators to divert calls and texts, intercept some SMS 2FA codes and send mass silent SMS, mainly to Taiwan. Enea assesses state-level activity with only low-confidence China ties.
Kaspersky describes a 10-day ransomware incident in which attackers used compromised vCenter and valid credentials to access ESXi, establish persistence, disrupt backups and render VMs unavailable. The article details investigative evidence and defensive measures.
Software engineer Toni Noble demonstrated that an ordinary Android app can read the clipboard and suppress Android’s access toast by showing its own. Google rated the report Moderate and closed it; no fix or release date is available.
PostgreSQL fixed 52 flaws, including CVE-2026-6460, a type-confusion bug that can let a user able to create objects run code as the PostgreSQL OS user. Exploitation has not been reported; affected versions require updates and extension rebuilds.
Researchers demonstrated Mior and Skyfall attacks that can expose data from AMD SEV-SNP VMs under different host-control conditions. AMD assigned CVEs and firmware fixes; neither advisory says the flaws have been used in attacks.
CYFIRMA reports 156 finance organizations named on ransomware leak sites in Q3 2026, alongside 2,657 finance phishing URLs, 104 finance-tagged CVEs and a rising share of state campaigns. It recommends rapid edge patching and stronger backup defenses.
DarkOwl reports 195 ransomware leak-site postings in one week and says the top 10 groups accounted for 71.1% of listed victims in Q1 2026. These postings indicate claims, not independently confirmed compromises.
A Recorded Future and UserEvidence survey of 768 enterprise cybersecurity professionals found that teams plan to increase threat intelligence spending, prioritize integration, and increasingly use intelligence in AI and automation workflows.
Varonis describes expanded Atlas AI detection and response across browsers, endpoints, gateways and agents, using task intent, identity and data sensitivity to detect risky actions and block, quarantine or review them.
A weekly cybersecurity roundup covers reported data exposure at Baker Tilly, AI-agent and supply-chain risks, Railway credential theft, malware targeting exposed SQL servers, connected-car flaws and an LLM backdoor technique.
GuardSix redesigned its free Academy with self-managed, role-based training and certification paths covering SIEM administration, deployments, integrations, automation, response workflows, and advanced normalization.
Trezor confirmed implants in three CryptoBilis-sold Safe 5 wallets that capture recovery phrases and transmit them over mobile networks. Firmware 2.13.1 blocks the implants found so far; no owners have reported lost funds.
Apify says an attacker used a compromised credential to access related accounts on Nov. 9–10. Customer data, including salted password hashes and authentication tokens, was accessed; the investigation continues.
TSMC confirmed employee data appeared on an external website and matched records held by an unnamed cloud provider. A seller’s claim of about 46,000 records remains unverified; TSMC says it found no evidence its own systems were compromised.
