Bypassing TLS certificate verification in 5 major TLS libraries with a LD\_PRELOAD lib.
* Works on OpenSSL, GnuTLS, NSS, mbedTLS, and wolfSSL.
* And most UNIX Systems
* Plus a deep dive into LD\_PRELOAD
Max severity Argo CD API flaw leaks repository credentials
Source: https://www.bleepingcomputer.com/news/security/max-severity-argo-cd-api-flaw-leaks-repository-credentials/
ESET researchers have identified a new threat actor, GhostRedirector, targeting Windows servers with custom tools. The group has compromised at least 65 servers, mainly in Brazil, Thailand, and Vietnam, across various sectors. Their arsenal includes Rungan, a passive C++ backdoor, and Gamshen, a malicious IIS module for SEO fraud. GhostRedirector also uses public exploits for privilege escalation and creates rogue user accounts to maintain access. The attacks aim to manipulate Google search results, promoting gambling websites through shady SEO techniques. Evidence suggests GhostRedirector is a China-aligned actor, active since at least August 2024. The campaign demonstrates sophisticated tactics for server compromise and long-term access maintenance.
This analysis examines a campaign distributing Atomic macOS Stealer (AMOS), targeting macOS users through fake 'cracked' applications. Attackers use two main delivery methods: malicious .dmg installers and terminal commands that bypass Gatekeeper protection. AMOS employs rotating domains to evade detection and steals a wide range of sensitive data, including credentials, browser information, cryptocurrency wallets, and system files. The campaign demonstrates sophisticated tactics, adapting to macOS security improvements and leveraging social engineering. The report emphasizes the importance of comprehensive endpoint detection, user education, and defense-in-depth strategies to combat such threats.
Hackers Grab $130M Using Brazil's Real-Time Payment System
Source: https://www.databreachtoday.co.uk/hackers-grab-130m-using-brazils-real-time-payment-system-a-29352
This article reviews IPv6 attack vectors (RA Spoofing, RDNSS Spoofing, IPv6 DNS Takeover with DHCPv6, SLAAC to DHCPv6 Downgrade, WPAD Poisoning) and their detection using Suricata signatures.
When Browsers Become the Attack Surface: Rethinking Security for Scattered Spider
Source: https://thehackernews.com/2025/09/when-browsers-become-attack-surface.html
ScarCruft Uses RokRAT Malware in Operation HanKook Phantom Targeting South Korean Academics
Source: https://thehackernews.com/2025/09/scarcruft-uses-rokrat-malware-in.html
So apparently agents are good enough nowadays that they can run a whole ransomware project on their own, getting in, lateral movement and then figuring out the appropriate ransom amount based on the information they got access to ...
The Interlock ransomware group has been actively targeting businesses and critical infrastructures in North America and Europe since September 2024. Their ransomware employs AES-256-GCM encryption with RSA-4096 key protection, leveraging the OpenSSL library for efficient file encryption. The malware includes code obfuscation techniques and specific arguments for various behaviors. It excludes certain folders, file extensions, and files from encryption to avoid system damage. The ransomware changes file extensions to '.!NT3RLOCK' and may terminate processes during encryption. Interlock's operations involve data theft and public disclosure threats for ransom leverage. The group utilizes a Tor-based negotiation site and references legal regulations to pressure victims. To counter this threat, offsite data backups and regular recovery drills are recommended.
A loophole in VS Code Marketplace allows malicious actors to reuse names of removed extensions. ReversingLabs discovered this vulnerability after finding a malicious extension with the same name as one previously identified. The platform's documentation states that extension names must be unique, but removed extensions' names can be reused. This poses a risk of threat actors publishing malicious extensions under previously legitimate names. The research team conducted experiments to confirm this vulnerability, successfully publishing extensions with names of removed packages. This technique has been observed in other open-source platforms like PyPI. The discovery highlights the increasing popularity of VS Code Marketplace among malicious actors and the need for developers to be vigilant about package security.
