Port 22

~ 3 Jan 2025 ~

LDAPNightmare PoC Exploit Crashes LSASS and Reboots Windows Domain Controllers

Critical Deadline: Update Old .NET Domains Before January 7, 2025 to Avoid Service Disruption

Apple to Pay Siri Users $20 Per Device in Settlement Over Accidental Siri Privacy Violations

~ 2 Jan 2025 ~

Chinese cyber-spies reportedly targeted sanctions intel in US Treasury raid

Apple agrees to settle Siri-snooping lawsuit for $95M

Google Is Allowing Device Fingerprinting

Severe Security Flaws Patched in Microsoft Dynamics 365 and Power Apps Web API

Cross-Domain Attacks: A Growing Threat to Modern Security and How to Combat Them

Malicious Obfuscated NPM Package Disguised as an Ethereum Tool Deploys Quasar RAT

Three Russian-German Nationals Charged with Espionage for Russian Secret Service

~ 1 Jan 2025 ~

Eight things that should not have happened last year, but did

Hey, Maybe It's Time to Delete Some Old Chat Histories

Iranian and Russian Entities Sanctioned for Election Interference Using AI and Cyber Tactics

US Army soldier who allegedly stole Trump's AT&T call logs arrested

~ 31 Dec 2024 ~

US Treasury Department outs the blast radius of BeyondTrust's key leak

China's cyber intrusions took a sinister turn in 2024

Gift Card Fraud

New U.S. DoJ Rule Halts Bulk Data Transfers to Adversarial Nations to Protect Privacy

Chinese APT Exploits BeyondTrust API Key to Access U.S. Treasury Systems and Documents

Misconfigured Kubernetes RBAC in Azure Airflow Could Expose Entire Cluster to Exploitation

U.S. Army Soldier Arrested in AT&T, Verizon Extortions

US Treasury Department Admits It Got Hacked by China

~ 30 Dec 2024 ~

More telcos confirm Salt Typhoon breaches as White House weighs in

New HIPAA Rules Mandate 72-Hour Data Restoration and Annual Compliance Audits

THN Weekly Recap: Top Cybersecurity Threats, Tools and Tips

Salt Typhoons Reach Continues to Grow

The Most Dangerous People on the Internet in 2024

When Good Extensions Go Bad: Takeaways from the Campaign Targeting Browser Extensions

~ 29 Dec 2024 ~

Happy 15th Anniversary, KrebsOnSecurity!

It's only a matter of time before LLMs jump start supply-chain attacks

16 Chrome Extensions Hacked, Exposing Over 600,000 Users to Data Theft

~ 28 Dec 2024 ~

How cops taking down LockBit, ALPHV led to RansomHub's meteoric rise

15,000+ Four-Faith Routers Exposed to New Exploit Due to Default Credentials

~ 27 Dec 2024 ~

North Korean Hackers Deploy OtterCookie Malware in Contagious Interview Campaign

Microsoft adds another problem to the Windows 11 24H2 naughty list

Casino Players Using Hidden Cameras for Cheating

The Paper Passport Is Dying

Cloud Atlas Deploys VBCloud Malware: Over 80% of Targets Found in Russia

Friday Squid Blogging: Squid on Pizza

Threat landscape for industrial automation systems in Q3 2024

Palo Alto Releases Patch for PAN-OS DoS Flaw Update Immediately

FICORA and Kaiten Botnets Exploit Old D-Link Vulnerabilities for Global Attacks

Apache MINA CVE-2024-52046: CVSS 10.0 Flaw Enables RCE via Unsafe Serialization

~ 26 Dec 2024 ~

Scams Based on Fake Google Emails

Brazilian Hacker Charged for Extorting $3.2M in Bitcoin After Breaching 300,000 Accounts

The Worst Hacks of 2024

~ 25 Dec 2024 ~

Ruijie Networks' Cloud Platform Flaws Could Expose 50,000 Devices to Remote Attacks

Critical SQL Injection Vulnerability in Apache Traffic Control Rated 9.9 CVSS Patch Now

Former NSA cyberspy's not-so-secret hobby: Hacking Christmas lights

You Need to Create a Secret Password With Your Family

Iran's Charming Kitten Deploys BellaCPP: A New C++ Variant of BellaCiao Malware

~ 24 Dec 2024 ~

How Androxgh0st rose from Mozi's ashes to become 'most prevalent malware'

Researchers Uncover PyPI Packages Stealing Keystrokes and Hijacking Social Accounts

Spyware Maker NSO Group Found Liable for Hacking WhatsApp

What do ransomware and Jesus have in common? A birth month and an unwillingness to die

North Korean Hackers Pull Off $308M Bitcoin Heist from Crypto Firm DMM Bitcoin

One third of adults can't delete device data

CISA Adds Acclaim USAHERDS Vulnerability to KEV Catalog Amid Active Exploitation

Apache Tomcat Vulnerability CVE-2024-56337 Exposes Servers to RCE Attacks

~ 23 Dec 2024 ~

'That's not a bug, it's a feature' takes on a darker tone when malware's involved

Criminal Complaint against LockBit Ransomware Writer

HBO documentary Surveilled investigates the growing business of commercial spyware

AI Could Generate 10,000 Malware Variants, Evading Detection in 88% of Case

Suspected LockBit dev, facing US extradition, 'did it for the money'

THN Weekly Recap: Top Cybersecurity Threats, Tools and Tips