Port 22

~ 9 Jan 2025 ~

Sweet QuaDreams or Nightmare before Christmas? Bill Marczak on Dissecting an iOS 0-Day

Zero-day exploits plague Ivanti Connect Secure appliances for second year running

New Banshee Stealer Variant Bypasses Antivirus with Apples XProtect-Inspired Encryption

Security pros baited with fake Windows LDAP exploit traps

Product Review: How Reco Discovers Shadow AI in SaaS

The School Shootings Were Fake. The Terror Was Real

The School Shootings Were Fake. The Terror Was Real

Webinar: Learn How to Stop Encrypted Attacks Before They Cost You Millions

MirrorFace Leverages ANEL and NOOPDOOR in Multi-Year Cyberattacks on Japan

Crypto is soaring, but so are threats: Heres how to keep your wallet safe

Critical RCE Flaw in GFI KerioControl Allows Remote Code Execution via CRLF Injection

E.U. Commission Fined for Transferring User Data to Meta in Violation of Privacy Laws

Ivanti Flaw CVE-2025-0282 Actively Exploited, Impacts Connect Secure and Policy Secure

Japanese Police claim China ran five-year cyberattack campaign targeting local orgs

Database tables of student, teacher info stolen from PowerSchool in cyberattack

Beyond Meh-trics: Examining How CTI Programs Demonstrate Value Using Metrics

~ 8 Jan 2025 ~

I tried hard, but didn't fix cybersecurity, admits outgoing US National Cyber Director

Mitel 0-day, 5-year-old Oracle RCE bug under active exploit

Neglected Domains Used in Malspam to Evade SPF and DMARC Security Protections

DNA sequencers found running ancient BIOS, posing risk to clinical research

UN's aviation agency confirms attack on recruitment database

Researchers Expose NonEuclid RAT Using UAC Bypass and AMSI Evasion Techniques

Top 5 Malware Threats to Prepare Against in 2025

Crims backdoored the backdoors they supplied to other miscreants. Then the domains lapsed

Mirai Botnet Variant Exploits Four-Faith Router Vulnerability for DDoS Attacks

FCC Launches 'Cyber Trust Mark' for IoT Devices to Certify Security Compliance

Akamai to quit its CDN in China, seemingly not due to trouble from Beijing

CISA Flags Critical Flaws in Mitel and Oracle Systems Amid Active Exploitation

FCC boss urges speedy spectrum auction to fund 'Rip'n'Replace' of Chinese kit

~ 7 Jan 2025 ~

A Day in the Life of a Prolific Voice Phishing Crew

License Plate Readers Are Leaking Real-Time Video Feeds and Vehicle Data

Turbulence at UN aviation agency as probe into potential data theft begins

DEF CON's hacker-in-chief faces fortune in medical bills after paralyzing neck injury

Researchers Uncover Major Security Flaw in Illumina iSeq 100 DNA Sequencers

US Treasury Department Sanctions Chinese Company Over Cyberattacks

Nedap Librix Ecoreader

ABB ASPECT-Enterprise, NEXUS, and MATRIX Series Products

Farewell to the Fallen: The Cybersecurity Stars We Lost Last Year

State-aligned actors are increasingly deploying ransomware and thats bad news for everyone

New EAGERBEE Variant Targets ISPs and Governments with Advanced Backdoor Capabilities

CISA: No Wider Federal Impact from Treasury Cyber Attack, Investigation Ongoing

Moxa Alerts Users to High-Severity Vulnerabilities in Cellular and Secure Routers

US adds web and gaming giant Tencent to list of Chinese military companies

~ 6 Jan 2025 ~

Charter, Consolidated, Windstream reportedly join China's Salt Typhoon victim list

Why security teams rely on Microsoft Defender Experts for XDR for managed detection and response

FireScam infostealer poses as Telegram Premium app to surveil Android devices

MediaTek rings in the new year with a parade of chipset vulns

India Proposes Digital Data Rules with Tough Penalties and Cybersecurity Requirements

Privacy of Photos.apps Enhanced Visual Search

THN Weekly Recap: Top Cybersecurity Threats, Tools and Tips [6 Jan]

From $22M in Ransom to +100M Stolen Records: 2025's All-Star SaaS Threat Actors to Watch

FireScam Android Malware Poses as Telegram Premium to Steal Data and Control Devices

AI moves to your PC with its own special hardware

After China's Salt Typhoon, the reconstruction starts now

Russian-Speaking Attackers Target Ethereum Devs with Fake Hardhat npm Packages

EAGERBEE, with updated and novel components, targets the Middle East

Taiwan reportedly claims China-linked ship damaged one of its submarine cables

Telemetry data from 800K VW Group EVs exposed online

~ 4 Jan 2025 ~

Encryption backdoor debate 'done and dusted,' former White House tech advisor says

Researchers Uncover Nuclei Vulnerability Enabling Signature Bypass and Code Execution

Apple May Owe You $20 in a Siri Privacy Lawsuit Settlement

Atos denies Space Bears' ransomware claims with a 'but'

PLAYFULGHOST Delivered via Phishing and SEO Poisoning in Trojanized VPN Apps

U.S. Treasury Sanctions Beijing Cybersecurity Firm for State-Backed Hacking Campaigns

~ 3 Jan 2025 ~

Friday Squid Blogging: Anniversary Post

Californians Say X Blocked Them From Viewing Amber Alert About Missing 14-Year-Old

ShredOS

CAPTCHAs now run Doom on nightmare mode

Boffins carve up C so code can be converted to Rust

Facebook and Instagram Ads Push Gun Silencers Disguised as Car Parts

New AI Jailbreak Method 'Bad Likert Judge' Boosts Attack Success Rates by Over 60%

Gary Marcus: Taming Silicon Valley | Starmus highlights

LDAPNightmare PoC Exploit Crashes LSASS and Reboots Windows Domain Controllers

Critical Deadline: Update Old .NET Domains Before January 7, 2025 to Avoid Service Disruption

Apple to Pay Siri Users $20 Per Device in Settlement Over Accidental Siri Privacy Violations

~ 2 Jan 2025 ~

Chinese cyber-spies reportedly targeted sanctions intel in US Treasury raid

Apple agrees to settle Siri-snooping lawsuit for $95M

Google Is Allowing Device Fingerprinting

Severe Security Flaws Patched in Microsoft Dynamics 365 and Power Apps Web API

Cross-Domain Attacks: A Growing Threat to Modern Security and How to Combat Them

Malicious Obfuscated NPM Package Disguised as an Ethereum Tool Deploys Quasar RAT

Three Russian-German Nationals Charged with Espionage for Russian Secret Service

~ 1 Jan 2025 ~

New "DoubleClickjacking" Exploit Bypasses Clickjacking Protections on Major Websites

Eight things that should not have happened last year, but did

Hey, Maybe It's Time to Delete Some Old Chat Histories

Iranian and Russian Entities Sanctioned for Election Interference Using AI and Cyber Tactics

US Army soldier who allegedly stole Trump's AT&T call logs arrested

~ 31 Dec 2024 ~

US Treasury Department outs the blast radius of BeyondTrust's key leak

China's cyber intrusions took a sinister turn in 2024

Gift Card Fraud

New U.S. DoJ Rule Halts Bulk Data Transfers to Adversarial Nations to Protect Privacy

Chinese APT Exploits BeyondTrust API Key to Access U.S. Treasury Systems and Documents

Misconfigured Kubernetes RBAC in Azure Airflow Could Expose Entire Cluster to Exploitation

U.S. Army Soldier Arrested in AT&T, Verizon Extortions

US Treasury Department Admits It Got Hacked by China

~ 30 Dec 2024 ~

More telcos confirm Salt Typhoon breaches as White House weighs in

New HIPAA Rules Mandate 72-Hour Data Restoration and Annual Compliance Audits

THN Weekly Recap: Top Cybersecurity Threats, Tools and Tips

Salt Typhoons Reach Continues to Grow

The Most Dangerous People on the Internet in 2024