UH officials refused to provide key information, including which cancer research project had been affected or how much UH paid the hackers to regain access to files. The post Hackers Accessed University of Hawaii Cancer Center Patient Data; They Weren’t Immediately Notified appeared first on SecurityWeek .
The Knownsec leak exposes a state-aligned Chinese cyber contractor deeply integrated with national security and intelligence operations. Internal documents reveal Knownsec's role in developing offensive cyber capabilities, large-scale reconnaissance systems, and data fusion platforms for public security bureaus and military clients. Key products include ZoomEye for global IP scanning, GhostX for exploitation, and Passive Radar for covert network mapping. The leak provides unprecedented insight into Knownsec's organizational structure, personnel, and strategic targeting of foreign critical infrastructure, particularly in Taiwan and other Asian countries. It demonstrates how commercial entities like Knownsec function as core components of China's cyber-espionage ecosystem, blending state objectives with industrial-scale development of intrusion and surveillance technologies.
Other noteworthy stories that might have slipped under the radar: Jaguar Land Rover sales crash, hundreds of gen-AI data policy violations, and Chinese cyberattacks against Taiwan intensified. The post In Other News: 8,000 Ransomware Attacks, China Hacked US Gov Emails, IDHS Breach Impacts 700k appeared first on SecurityWeek .
The North Korean state-sponsored espionage group Kimsuky has targeted government organizations, think tanks, and academic institutions. The post FBI: North Korean Spear-Phishing Attacks Use Malicious QR Codes appeared first on SecurityWeek .
Radware bypassed ChatGPT’s protections to exfiltrate user data and implant a persistent logic into the agent’s long-term memory. The post ‘ZombieAgent’ Attack Let Researchers Take Over ChatGPT appeared first on SecurityWeek .
Gulshan Management Services has informed authorities about a recent data breach resulting from a ransomware attack. The post 377,000 Impacted by Data Breach at Texas Gas Station Firm appeared first on SecurityWeek .
CNCERT and Microstep Online jointly detected a cyberattack campaign launched by the "Black Cat" criminal gang. This gang uses search engine SEO (Search Engine Optimization) techniques to push meticulously crafted phishing websites to the top of search engine keyword results. After visiting these high-ranking phishing pages, users are lured by carefully designed download pages, attempting to download software installation packages bundled with malicious programs. Once installed, the program implants a backdoor Trojan without the user's knowledge, leading to the theft of sensitive data from their host computer by attackers.
The PHALT#BLYX campaign targets the hospitality sector using sophisticated social engineering and advanced techniques. It begins with a phishing email mimicking a Booking.com reservation cancellation, leading victims to a fake website. Users are tricked into executing malicious PowerShell commands through a fake BSOD and click-fix social engineering tactic. The malware leverages MSBuild.exe to bypass defenses and deploys a customized DCRat payload. It establishes persistence, disables Windows Defender, and uses process hollowing to inject into legitimate processes. The campaign shows evolution from earlier, simpler methods and demonstrates a deep understanding of modern endpoint protection. Attribution points to Russian-speaking threat actors, given the presence of Cyrillic debug strings and the use of DCRat, a popular tool in Russian underground forums.
Reverse engineers must have a good understanding of the environment where malware are executed (read: the operating system). In a previous diary, I talked about malicious code that could be executed when loading a DLL[1]. Today, I'll show you how a malware can hide suspicious information related to created processes.
CVE-2026-20974 is a medium-severity vulnerability affecting Samsung Mobile devices due to improper input validation related to network restrictions. This flaw allows a physical attacker to bypass the Carrier Relock feature, which is intended to restrict device use to specific carriers. The vulnerability requires physical access but no authentication or user interaction, and it does not impact confidentiality or availability directly but compromises device integrity. There are no known exploits in the wild, and no patches have been linked yet. European organizations using Samsung Mobile devices could face risks of unauthorized carrier unlocking, potentially leading to unauthorized network access or device misuse. Mitigation involves monitoring for firmware updates from Samsung and restricting physical access to devices. Countries with high Samsung device penetration and significant mobile carrier infrastructure, such as Germany, France, the UK, Italy, and Spain, are most likely to be affected. Given the medium CVSS score of 5.2, the threat is moderate but should be addressed proactively to prevent exploitation.
CVE-2026-20972 is a medium severity vulnerability affecting Samsung Mobile devices, caused by improper export of Android application components in the UwbTest app prior to the SMR Jan-2026 Release 1. This flaw allows local attackers with limited privileges to enable Ultra-Wideband (UWB) functionality without user interaction or elevated authentication. The vulnerability arises from CWE-926, which involves improper export of application components, potentially exposing sensitive device capabilities. Although no known exploits are currently reported in the wild, the vulnerability could be leveraged to manipulate UWB features, possibly impacting device confidentiality or integrity. The CVSS score of 4.8 reflects a moderate risk due to the local attack vector and required privileges. European organizations using Samsung Mobile devices with affected firmware versions should be aware of this issue and apply vendor updates once available. Mitigation involves restricting local access, monitoring device behavior, and applying security patches promptly. Countries with high Samsung Mobile market penetration and strategic use of UWB technology, such as Germany, France, and the UK, are most likely to be impacted.
CVE-2025-14803 is a stored Cross-Site Scripting (XSS) vulnerability in the NEX-Forms WordPress plugin versions before 9.1.8. The flaw arises because certain plugin settings are not properly sanitized or escaped, allowing authenticated subscribers to inject malicious scripts. Exploitation requires subscriber-level privileges and user interaction, but can lead to full compromise of confidentiality, integrity, and availability of affected sites. The vulnerability has a CVSS score of 6.8, indicating medium severity. No known exploits are currently reported in the wild. European organizations using NEX-Forms on WordPress should prioritize patching or mitigating this issue to prevent potential account takeover, data theft, or site defacement. Countries with high WordPress adoption and significant use of NEX-Forms, such as Germany, the UK, and France, are most likely to be impacted.
CVE-2025-14505 is a medium-severity vulnerability in the Elliptic package's ECDSA implementation, where an incorrect computation of the byte-length of the ephemeral value 'k' leads to truncation when 'k' has leading zeros. This flaw causes faulty digital signatures and breaks legitimate transactions or communications. More critically, attackers who obtain both a faulty signature and a correct signature for the same input under certain conditions may derive the secret private key, compromising cryptographic confidentiality. The vulnerability affects all Elliptic versions up to and including 6.6.1. Exploitation requires network access but no privileges or user interaction, and no known exploits are currently in the wild. European organizations relying on Elliptic for cryptographic operations, especially in financial or blockchain applications, face risks of transaction failures and potential key compromise. Mitigation involves updating to a patched Elliptic version once available, auditing signature generation for anomalies, and implementing additional cryptographic safeguards. Countries with significant blockchain, fintech, and cryptography-dependent sectors such as Germany, the UK, France, and the Netherlands are most likely to be impacted.
ASEC discovered Guloader malware being distributed through phishing emails masquerading as employee performance reports. The emails, claiming to be about October 2025 performance, contain a RAR file with an NSIS executable named 'staff record pdf.exe'. This file is actually Guloader malware, which downloads and executes shellcode from a Google Drive URL. The final payload is Remcos RAT, enabling threat actors to perform various malicious remote control activities, including keylogging, screenshot capture, webcam and microphone control, and browser data extraction. The attackers are increasingly using legitimate platforms as C2 servers, making detection more challenging. Users are advised to exercise caution when opening emails from unknown sources and to change passwords regularly to prevent secondary damage.
The Boto Cor-de-Rosa campaign reveals Astaroth's new strategy of exploiting WhatsApp Web for propagation. This Brazilian banking malware now uses a Python-based worm module to retrieve victims' WhatsApp contact lists and automatically send malicious messages, expanding its infection reach. The attack begins with a malicious ZIP file sent via WhatsApp, containing a Visual Basic script that downloads additional components. The malware then operates two parallel modules: a propagation module for spreading through WhatsApp contacts, and a banking module for credential stealing. This campaign demonstrates Astaroth's evolution, combining traditional malware techniques with sophisticated social engineering and multi-platform propagation, primarily targeting Brazilian users.
