U.S. CISA adds Microsoft Internet Explorer, Microsoft Office Excel, and WinRAR flaws to its Known Exploited Vulnerabilities catalog
Source: https://securityaffairs.com/181110/hacking/u-s-cisa-adds-microsoft-internet-explorer-microsoft-office-excel-and-winrar-flaws-to-its-known-exploited-vulnerabilities-catalog.html
How "helpful" AI assistants are accidentally destroying production systems - and what we're doing about it.
Source: https://profero.io/blog/new-attack-vector--ai-induced-destruction
A VBS-based infostealer called Cmimai Stealer has emerged, targeting Windows systems since June 2025. It collects system information, browser metadata, and screenshots, exfiltrating data via Discord webhooks. The malware uses PowerShell scripts for browser data collection and screen capture, running in a persistent loop every hour. It leverages WMI for system information gathering and employs JSON formatting for data exfiltration. While lacking advanced features like encrypted communication or credential theft, Cmimai Stealer serves as both an infostealer and a reconnaissance tool. Defensive considerations include monitoring high-risk process combinations, watching for specific PowerShell scripts and image files, and detecting Discord traffic with a unique User-Agent.
CastleLoader, a versatile malware loader, has infected 469 devices since May 2025 using Cloudflare-themed ClickFix phishing and fake GitHub repositories. It delivers information stealers and RATs, with a 28.7% infection rate. The malware employs sophisticated techniques, including PowerShell and AutoIT scripts, to load shellcode into memory and connect to C2 servers. CastleLoader's modular design allows deployment of multiple payloads, including StealC, RedLine, NetSupport RAT, DeerStealer, HijackLoader, and SectopRAT. Its campaigns target U.S.government entities and use legitimate file-sharing services and compromised websites for payload retrieval, enhancing resilience against takedowns.
Docker Hub still hosts dozens of Linux images with the XZ backdoor
Source: https://www.bleepingcomputer.com/news/security/docker-hub-still-hosts-dozens-of-linux-images-with-the-xz-backdoor/
Interlock Ransomware Group Leaks 43GB of Data in City of St. Paul Cyberattack
Source: https://hackread.com/interlock-ransomware-leaks-st-paul-city-cyberattack-data/
New TETRA Radio Encryption Flaws Expose Law Enforcement Communications
Source: https://thehackernews.com/2025/08/new-tetra-radio-encryption-flaws-expose.html
Pentest Trick: Out of sight, out of mind with Windows Long File Names
Source: https://www.zerosalarium.com/2025/08/pentest-trick-out-of-sight-out-of-mind-long-filename.html
FTC: older adults lost record $700 million to scammers in 2024
Source: https://www.bleepingcomputer.com/news/security/ftc-older-adults-lost-record-700-million-to-scammers-in-2024/
A routine monitoring by researchers uncovered an exploitation attempt on a honeypot server running TeamCity, a CI/CD tool. The attack exploited an exposed Java Debug Wire Protocol (JDWP) interface, leading to remote code execution, deployment of cryptomining payload, and establishment of multiple persistence mechanisms. The attack was notable for its rapid exploitation, use of a customized XMRig payload, and stealthy crypto-mining techniques. JDWP, designed for debugging Java applications, becomes a high-risk entry point when exposed to the Internet without proper authentication. The attackers used a structured sequence to achieve remote code execution, likely using a variant of jdwp-shellifier. They deployed a dropper script that installed an XMRig miner and set up various persistence mechanisms including boot scripts, systemd services, cron jobs, and shell configuration files.
New EDR killer tool used by eight different ransomware groups
Source: https://www.bleepingcomputer.com/news/security/new-edr-killer-tool-used-by-eight-different-ransomware-groups/
This intelligence report analyzes a sophisticated tool designed to disable endpoint security solutions, particularly EDR systems, on infected systems. The tool, known as AVKiller, has been observed in multiple ransomware attacks since 2022. It is heavily protected, targets various security vendors, and uses a driver with a compromised certificate to terminate processes and services. The report details the tool's characteristics, its connection to ransomware attacks, and provides examples of its use in specific ransomware families. Notably, the report highlights evidence of tool sharing and technical knowledge transfer among competing ransomware groups, suggesting a more complex ecosystem than previously thought.
Akira ransomware abuses CPU tuning tool to disable Microsoft Defender
Source: https://www.bleepingcomputer.com/news/security/akira-ransomware-abuses-cpu-tuning-tool-to-disable-microsoft-defender/
Over 100 Dell Laptop Models Plagued by Vulnerabilities Impacting Millions
Source: https://hackread.com/dell-laptop-models-vulnerabilities-impacting-millions/
New Plague Linux malware stealthily maintains SSH access
Source: https://www.bleepingcomputer.com/news/security/new-plague-malware-backdoors-linux-devices-removes-ssh-session-traces/
