Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3800 articles
ESET says China-aligned GopherWhisper has been active since November 2023, finding 12 backdoored systems at one Mongolian government institution and evidence of dozens more potential victims. Five backdoors use varied cloud services for C2 or file transfer.
The U.S. sanctioned Cambodian senator Kok An and 28 associates over alleged scam-center operations tied to cryptocurrency investment fraud, trafficking and money laundering. A DOJ-led task force also seized 503 domains and announced related charges and victim-noticeeff
This week’s roundup covers a $290M KelpDAO exploit that LayerZero said may be linked to TraderTraitor, malicious npm packages, active RCEs, AI-agent prompt injection, stealth techniques, and other security developments.
Dragos analyst Jimmy Wyles says ZionSiphon, reported as targeting Israeli water facilities, is dysfunctional and poses no real threat due to broken logic, flawed OT assumptions and likely AI-generated errors. He warns it could distract from established threats like Volt
ESET reports that GopherWhisper, a China-aligned actor active since at least November 2023, targeted a Mongolian government entity with Go-based malware, used Discord, Slack and Outlook for command and control, and exfiltrated files via File[.]io.
Citizen Lab reported that surveillance vendors used hidden SMS commands and weaknesses in SS7 and Diameter signaling to track users’ locations. Researchers said traffic routing suggested a possible link to an Israeli company.
Symantec reports that recent Trigona attacks used uploader_client.exe to exfiltrate data with parallel uploads and TCP rotation, alongside kernel-driver abuse, privilege escalation, remote access and credential theft.
Cisco researchers demonstrated that NPM post-install hooks could modify Claude Code’s memory file, preserving malicious instructions across sessions. Anthropic has mitigated the issue; researchers recommend scanning or purging memory files.
U.S. and allied agencies warn that China-linked actors are using evolving networks of compromised SOHO routers, IoT and smart devices for reconnaissance, malware delivery and espionage, and recommend hunting, network mapping and blocklists.
Cloudsmith raised $72 million in a Series C round led by TCV. The software artifact platform says it detects vulnerabilities and malicious code in packages and uses policies to control distribution.
Sean Plankey withdrew from consideration to lead CISA after his nomination stalled in the Senate for more than a year. CISA remains under Acting Director Nick Andersen after reported workforce losses and furloughs.
ESET reports that China-linked GopherWhisper has targeted government entities since at least 2023, using custom backdoors over Slack, Discord and Outlook. Telemetry showed 12 systems compromised at a Mongolian institution; C2 traffic indicated dozens more victims.
The UK NCSC and partners warn that China-nexus actors increasingly route operations through botnets of hijacked SOHO routers and IoT devices. The advisory cites Raptor Train and KV-Botnet and recommends MFA, dynamic threat feeds, allowlisting and zero-trust controls.
360 Digital Security Group claims its AI system contributed to roughly half of its findings at Tianfu Cup, where the firm says it identified nearly 1,000 vulnerabilities. An expert questions whether its capabilities match Claude Mythos.
Cybersecurity startup Rilian raised $17.5 million in seed funding. It says the investment will support hiring, R&D, and expansion as it develops Caspian, an AI-based security orchestration platform for government, critical infrastructure, and other organizations.
OpenAI released Privacy Filter, an open-weight model for locally detecting and redacting PII. OpenAI reports F1 scores of 96% and 97.43% on benchmark versions, but cautions that high-sensitivity use requires human review.
ESET reports that GopherWhisper targeted Mongolian government systems with Go-heavy backdoors, using Discord, Slack, Outlook and file[.]io for C2 or exfiltration. Telemetry showed about 12 infections; initial access is unknown.
LangWatch released Scenario, an open-source framework that automates multi-turn red-team tests of AI agents. It uses four-phase Crescendo escalation, a scoring model to adapt attacks, and persistent attacker memory across attempts.
Trend Micro says North Korean actor Void Dokkaebi uses fake developer job interviews and malicious VS Code tasks to spread malware through repositories, steal credentials, and stage payloads on blockchain networks.
House Republicans unveiled a draft Secure Data Act that would set consumer data rights, limit collection, require safeguards and expand FTC oversight of data brokers. Critics say it preempts stronger state laws and leaves enforcement and AI privacy gaps.
Sean Plankey asked President Trump to withdraw his CISA director nomination after 13 months without Senate confirmation. The agency remains under acting leadership amid personnel reductions and proposed budget cuts.
Mozilla says Claude Mythos identified 271 vulnerabilities in Firefox 150; an earlier Opus 4.6 scan led to 22 fixes in Firefox 148. Anthropic limits Mythos access through Project Glasswing amid misuse concerns and reports of unauthorized access.
Expel investigators linked the HexagonalRodent campaign to North Korean actors and said it stole up to $12 million from 26,584 crypto wallets on 2,726 systems, using malware and fake job offers targeting Web3 developers.
Socket reports that attackers altered Checkmarx KICS Docker image tags and that some VS Code extensions ran malicious code. The KICS binary could exfiltrate scan reports; the Docker repository was archived.
