Port 22

~ 6 Jan 2025 ~

After China's Salt Typhoon, the reconstruction starts now

Russian-Speaking Attackers Target Ethereum Devs with Fake Hardhat npm Packages

EAGERBEE, with updated and novel components, targets the Middle East

Taiwan reportedly claims China-linked ship damaged one of its submarine cables

Telemetry data from 800K VW Group EVs exposed online

~ 4 Jan 2025 ~

Encryption backdoor debate 'done and dusted,' former White House tech advisor says

Researchers Uncover Nuclei Vulnerability Enabling Signature Bypass and Code Execution

Apple May Owe You $20 in a Siri Privacy Lawsuit Settlement

Atos denies Space Bears' ransomware claims with a 'but'

PLAYFULGHOST Delivered via Phishing and SEO Poisoning in Trojanized VPN Apps

U.S. Treasury Sanctions Beijing Cybersecurity Firm for State-Backed Hacking Campaigns

~ 3 Jan 2025 ~

Friday Squid Blogging: Anniversary Post

Californians Say X Blocked Them From Viewing Amber Alert About Missing 14-Year-Old

ShredOS

CAPTCHAs now run Doom on nightmare mode

Boffins carve up C so code can be converted to Rust

Facebook and Instagram Ads Push Gun Silencers Disguised as Car Parts

New AI Jailbreak Method 'Bad Likert Judge' Boosts Attack Success Rates by Over 60%

Gary Marcus: Taming Silicon Valley | Starmus highlights

LDAPNightmare PoC Exploit Crashes LSASS and Reboots Windows Domain Controllers

Critical Deadline: Update Old .NET Domains Before January 7, 2025 to Avoid Service Disruption

Apple to Pay Siri Users $20 Per Device in Settlement Over Accidental Siri Privacy Violations

~ 2 Jan 2025 ~

Chinese cyber-spies reportedly targeted sanctions intel in US Treasury raid

Apple agrees to settle Siri-snooping lawsuit for $95M

Google Is Allowing Device Fingerprinting

Severe Security Flaws Patched in Microsoft Dynamics 365 and Power Apps Web API

Cross-Domain Attacks: A Growing Threat to Modern Security and How to Combat Them

Malicious Obfuscated NPM Package Disguised as an Ethereum Tool Deploys Quasar RAT

Three Russian-German Nationals Charged with Espionage for Russian Secret Service

~ 1 Jan 2025 ~

New "DoubleClickjacking" Exploit Bypasses Clickjacking Protections on Major Websites

Eight things that should not have happened last year, but did

Hey, Maybe It's Time to Delete Some Old Chat Histories

Iranian and Russian Entities Sanctioned for Election Interference Using AI and Cyber Tactics

US Army soldier who allegedly stole Trump's AT&T call logs arrested

~ 31 Dec 2024 ~

US Treasury Department outs the blast radius of BeyondTrust's key leak

China's cyber intrusions took a sinister turn in 2024

Gift Card Fraud

New U.S. DoJ Rule Halts Bulk Data Transfers to Adversarial Nations to Protect Privacy

Chinese APT Exploits BeyondTrust API Key to Access U.S. Treasury Systems and Documents

Misconfigured Kubernetes RBAC in Azure Airflow Could Expose Entire Cluster to Exploitation

U.S. Army Soldier Arrested in AT&T, Verizon Extortions

US Treasury Department Admits It Got Hacked by China

~ 30 Dec 2024 ~

More telcos confirm Salt Typhoon breaches as White House weighs in

New HIPAA Rules Mandate 72-Hour Data Restoration and Annual Compliance Audits

THN Weekly Recap: Top Cybersecurity Threats, Tools and Tips

Salt Typhoons Reach Continues to Grow

The Most Dangerous People on the Internet in 2024

When Good Extensions Go Bad: Takeaways from the Campaign Targeting Browser Extensions

~ 29 Dec 2024 ~

Happy 15th Anniversary, KrebsOnSecurity!

It's only a matter of time before LLMs jump start supply-chain attacks

16 Chrome Extensions Hacked, Exposing Over 600,000 Users to Data Theft

~ 28 Dec 2024 ~

How cops taking down LockBit, ALPHV led to RansomHub's meteoric rise

15,000+ Four-Faith Routers Exposed to New Exploit Due to Default Credentials

~ 27 Dec 2024 ~

North Korean Hackers Deploy OtterCookie Malware in Contagious Interview Campaign

Microsoft adds another problem to the Windows 11 24H2 naughty list

Casino Players Using Hidden Cameras for Cheating

The Paper Passport Is Dying

Cloud Atlas Deploys VBCloud Malware: Over 80% of Targets Found in Russia

Friday Squid Blogging: Squid on Pizza

Threat landscape for industrial automation systems in Q3 2024

This month in security with Tony Anscombe December 2024 edition

Palo Alto Releases Patch for PAN-OS DoS Flaw Update Immediately

FICORA and Kaiten Botnets Exploit Old D-Link Vulnerabilities for Global Attacks

Apache MINA CVE-2024-52046: CVSS 10.0 Flaw Enables RCE via Unsafe Serialization

~ 26 Dec 2024 ~

Scams Based on Fake Google Emails

Brazilian Hacker Charged for Extorting $3.2M in Bitcoin After Breaching 300,000 Accounts

The Worst Hacks of 2024

~ 25 Dec 2024 ~

Ruijie Networks' Cloud Platform Flaws Could Expose 50,000 Devices to Remote Attacks

Critical SQL Injection Vulnerability in Apache Traffic Control Rated 9.9 CVSS Patch Now

Former NSA cyberspy's not-so-secret hobby: Hacking Christmas lights

You Need to Create a Secret Password With Your Family

Iran's Charming Kitten Deploys BellaCPP: A New C++ Variant of BellaCiao Malware

~ 24 Dec 2024 ~

How Androxgh0st rose from Mozi's ashes to become 'most prevalent malware'

Researchers Uncover PyPI Packages Stealing Keystrokes and Hijacking Social Accounts

Spyware Maker NSO Group Found Liable for Hacking WhatsApp

What do ransomware and Jesus have in common? A birth month and an unwillingness to die

North Korean Hackers Pull Off $308M Bitcoin Heist from Crypto Firm DMM Bitcoin

One third of adults can't delete device data

CISA Adds Acclaim USAHERDS Vulnerability to KEV Catalog Amid Active Exploitation

Apache Tomcat Vulnerability CVE-2024-56337 Exposes Servers to RCE Attacks

~ 23 Dec 2024 ~

'That's not a bug, it's a feature' takes on a darker tone when malware's involved

Criminal Complaint against LockBit Ransomware Writer

HBO documentary Surveilled investigates the growing business of commercial spyware

AI Could Generate 10,000 Malware Variants, Evading Detection in 88% of Case

Suspected LockBit dev, facing US extradition, 'did it for the money'

THN Weekly Recap: Top Cybersecurity Threats, Tools and Tips

Rockstar2FA Collapse Fuels Expansion of FlowerStorm Phishing-as-a-Service

Cloud Atlas seen using a new tool in its attacks

The Invisible Russia-Ukraine Battlefield

Chris Hadfield: The sky is falling what to do about space junk? | Starmus highlights

Top 10 Cybersecurity Trends to Expect in 2025

UK ICO not happy with Google's plans to allow device fingerprinting

U.S. Judge Rules Against NSO Group in WhatsApp Pegasus Spyware Case

Italy Fines OpenAI 15 Million for ChatGPT GDPR Data Privacy Violations

SANS Threat Analysis Rundown in Review: Breaking Down December 2024s Discussion

~ 21 Dec 2024 ~

Mystery Drone Sightings Lead to FAA Ban Despite No Detected Threats

LockBit Developer Rostislav Panev Charged for Billions in Global Ransomware Damages

~ 20 Dec 2024 ~

Friday Squid Blogging: Squid Sticker

Lazarus Group Spotted Targeting Nuclear Engineers with CookiePlus Malware

BellaCPP: Discovering a new BellaCiao variant written in C++