The Multilateral Sanctions Monitoring Team (MSMT) has released a comprehensive report documenting systematic violations of UN sanctions by North Korea. Between 2024 and 2025, North Korean cyber operations have achieved unprecedented scale in cryptocurrency theft. In 2024 alone, DPRK-linked actors stole approximately USD 1.19 billion a 50 percent year-on-year increase. Revealing how the Democratic People’s […]
The Tor Project has announced a significant cryptographic overhaul, retiring its legacy relay encryption algorithm after decades of service and replacing it with Counter Galois Onion (CGO).
This research-backed encryption design defends against a broader class of sophisticated online attackers.
Tor’s relay encryption serves a specialized function distinct from the standard TLS protocol used between relays and clients.
This algorithm encrypts user data as it traverses multiple relays in a circuit, with clients sharing symmetric keys with each relay and progressively removing encryption layers.
The current system, now designated “tor1,” dates back to Tor’s early years when modern cryptographic practices were still emerging.
While functional, tor1’s design exhibits several vulnerabilities that researchers have successfully exploited in controlled settings.
Critical Vulnerabilities Addressed
The most severe threat is tagging attacks, in which active adversaries modify encrypted traffic at a single network point and observe predictable changes elsewhere.
Tor1’s reliance on AES-128-CTR encryption without hop-by-hop authentication creates a malleable ciphertext.
Attackers can XOR patterns into encrypted cells, knowing that modifications will persist through decryption layers.
By controlling both circuit endpoints, adversaries can inject identifiers such as IP addresses that traverse the entire path undetected.
This represents an “Internal Covert Channel” attack, enabling definite deanonymization before any application traffic flows.
Beyond tagging vulnerabilities, tor1 suffers from limited forward secrecy. Keys persist throughout a circuit’s lifetime, meaning stolen keys compromise all historical traffic.
The algorithm also employs only a 4-byte authentication digest roughly a 1-in-4-billion forgery probability relying on path-bias detection rather than cryptographic strength.
Additionally, tor1 uses SHA-1, an increasingly compromised hashing function.
Developed by cryptographers Jean Paul Degabriele, Alessandro Melloni, Jean-Pierre Münch, and Martijn Stam, CGO implements a Rugged Pseudorandom Permutation (RPRP) construction explicitly designed for Tor’s asymmetric encryption model.
Unlike full Strong Pseudorandom Permutations, which require two passes over the data, the UIV+ foundation enables one-directional tagging resistance at reduced computational cost.
Originating a CGO message
CGO addresses all identified vulnerabilities. Wide-block construction ensures that any tampering renders the entire message unrecoverable.
Chaining authentication tags across cells means that single-cell modifications garble all subsequent messages.
Immediate forward secrecy is provided by the Update algorithm, which irreversibly transforms keys after each cell, preventing decryption of historical traffic. Authentication now uses a robust 16-byte authenticator, replacing the deprecated digest.
The Tor Project has implemented CGO in Arti (Rust) and in C for relay compatibility. Development required extensive refactoring to eliminate assumptions about relay cell structure.
Next steps include enabling CGO by default in Arti, implementing onion service negotiation protocols, and optimizing performance for modern CPUs.
While CGO represents a relatively new cryptographic design still undergoing academic scrutiny, researchers emphasize that identified weaknesses are unlikely to exceed tor1’s vulnerabilities.
Adoption means a methodical progression toward stronger anonymity protections for millions of Tor users worldwide.
Microsoft Teams is set to launch a key update for its Windows desktop client, introducing a new child process, ms-teams_modulehost.exe, to boost the performance of calling features and reduce startup times. This change separates the calling stack from the primary ms-teams.exe process, allowing better resource management and smoother meetings without altering user interfaces or workflows. […]
Anthropic researchers have discovered a troubling phenomenon in the development of artificial intelligence: when large language models learn to “reward hack” during coding tasks, they subsequently exhibit malicious behavior in completely unrelated contexts, including sabotaging safety research and cooperating with hackers. What Is Reward Hacking? Reward hacking occurs when AI models find shortcuts to maximize […]
Microsoft has announced a significant update to the Teams Desktop Client for Windows that aims to enhance performance and reduce startup times for calling features.
The update, detailed in the Message Center notification MC1189656 published on November 25, 2025, introduces a new process architecture designed to optimize resource usage and improve meeting experiences.
New Process Architecture for Better Performance
The upcoming change introduces a new child process, ms-teams_modulehost.exe, that will run separately from the primary Teams application process (ms-teams.exe).
Performance Improvement – The new architecture optimizes resource usage, delivering faster startup times and smoother meeting experiences through better workload distribution.
Separate Process Architecture – The calling stack now runs in its own dedicated child process rather than consuming resources from the main application, reducing system overhead.
Transparent to Users – No changes to user workflows or interface; the performance benefits happen entirely in the background.
This dedicated process will handle the calling stack independently, allowing Teams to distribute workloads more efficiently across system resources.
After the update, users who open Task Manager will notice a new process running under the primary Teams process.
Separating calling features into a dedicated module is expected to deliver faster startup times and smoother performance during meetings and calls.
Microsoft plans to begin the worldwide rollout in early January 2026, with completion expected by late January 2026.
The update will be available across all environments, including Worldwide, GCC, GCC High, and DoD tenants. However, Microsoft has noted that timelines may shift due to year-end feature flag rollout freezes.
Users will not experience any changes to their daily workflows or the Teams interface.
The performance improvements occur entirely in the background, so employees can continue using Teams as they usually do without needing to learn new features or adapt to interface changes.
While end users will not need to take any action, IT administrators should prepare their environments before the rollout begins.
Organisations should update endpoint management and security software to allowlist the new ms-teams_modulehost.exe process alongside the existing ms-teams.exe.
This ensures security solutions do not block or interfere with the new component.
Helpdesk teams should be informed about this change to prevent confusion during troubleshooting sessions.
When users report seeing a new process in Task Manager, support staff should recognise this as expected behaviour.
Internal documentation that references Teams process names should be updated to include the new module host process.
Microsoft has indicated that no compliance considerations have been identified with this update.
However, organisations are encouraged to review the change in accordance with their compliance requirements and security policies.
This update represents Microsoft’s continued commitment to improving Teams’ performance as the platform remains central to workplace collaboration.
By optimising how calling features are processed, organisations can expect more responsive meeting experiences and faster application startup times beginning in early 2026.
Water Gamayun, a Russia‑aligned advanced persistent threat (APT) group, has launched a new multi‑stage intrusion campaign that weaponizes the recently disclosed MSC EvilTwin vulnerability in Windows Microsoft Management Console (MMC). Leveraging a blend of compromised infrastructure, social engineering, and heavily obfuscated PowerShell, the attackers exploited CVE‑2025‑26633 to inject malicious code into mmc.exe, ultimately delivering hidden […]
ASUS has disclosed a high security vulnerability in its MyASUS application that could allow local attackers to escalate their privileges to SYSTEM-level access on affected Windows devices.
The flaw, tracked as CVE-2025-59373, carries a high-severity CVSS 4.0 score of 8.5, indicating a significant risk to millions of ASUS computer users worldwide.
Vulnerability Overview
The security flaw resides in the ASUS System Control Interface Service, a core component of the MyASUS application that manages hardware settings and system utilities on ASUS personal computers.
The vulnerability enables attackers with low-level local access to escalate their privileges to SYSTEM-level, granting them complete control over the affected machine.
CVE ID
Affected Product
Impact
CVSS 4.0 Score
Exploit Prerequisites
CVE-2025-59373
ASUS System Control Interface Service (MyASUS)
Privilege Escalation to SYSTEM
8.5 (High)
Local access with low privileges
With SYSTEM-level access, threat actors can execute arbitrary code, install malware, access sensitive data, modify system configurations, and potentially move laterally across enterprise networks.
This makes the vulnerability particularly dangerous in corporate environments where a single compromised endpoint could lead to broader network intrusion.
The vulnerability requires local access to exploit, meaning an attacker must already have some level of access to the target system.
However, the attack complexity is low, requires no user interaction, and only minimal privileges are needed to trigger the exploit.
The potential impact spans high confidentiality, integrity, and availability concerns, though the scope remains unchanged beyond the vulnerable component.
The vulnerability affects all ASUS personal computers running the MyASUS application, including desktops, laptops, NUC systems, and All-in-One PCs. ASUS has released patched versions to address the issue.
Users should update to the following fixed versions immediately:
ASUS System Control Interface 3.1.48.0 for x64 systems
ASUS System Control Interface 4.2.48.0 for ARM-based devices
To verify the current installed version, users can navigate to MyASUS, then select Settings and click About to view the version information.
ASUS urges all users to apply the security update as soon as possible. The update can be obtained through Windows Update, which will automatically deliver the patch to eligible systems.
Organizations running ASUS devices across their networks should prioritize deploying this patch given its high severity rating and the potential for privilege-escalation attacks.
Security teams should also monitor systems for any suspicious activity that could indicate exploitation attempts.
The U.S. Federal Bureau of Investigation (FBI) has warned that cybercriminals are impersonating financial institutions with an aim to steal money or sensitive information to facilitate account takeover (ATO) fraud schemes.
The activity targets individuals, businesses, and organizations of varied sizes and across sectors, the agency said, adding the fraudulent schemes have led to more than $262
Modern cybersecurity faces an escalating challenge: fileless malware and obfuscation techniques increasingly bypass traditional file-based detection methods.
To address this growing threat, JPCERT/CC has released YAMAGoya. This open-source threat hunting tool leverages industry-standard detection rules to identify suspicious activity in real time.
YAMAGoya represents a significant advancement in endpoint threat detection by combining Event Tracing for Windows (ETW) event monitoring with memory scanning capabilities.
Open-Source Endpoint Detection Solution
Unlike conventional security tools that rely on proprietary detection engines, YAMAGoya directly supports Sigma and YARA rules.
Enabling security analysts to deploy community-driven detection logic across their infrastructure.
The tool operates entirely in userland, requiring no kernel driver installation, which simplifies deployment across organizational environments.
Its real-time monitoring capabilities track files, processes, registry modifications, DNS queries, network connections, PowerShell execution, and WMI commands simultaneously.
YAMAGoya startup screen
This comprehensive approach enables the detection of both traditional and fileless malware threats.
According to JPCERT/CC, YAMAGoya supports multiple rule formats, including Sigma rules, YARA rules for memory scanning, and custom YAML rules for correlation-based detection.
JPCERT/CC security teams can create sophisticated detection logic that correlates multiple events.
Such as file creation followed by process execution, DLL loading, and network communication, to identify malicious activity patterns.
The tool is available for immediate evaluation through pre-built binaries on GitHub, with source code available for organizations requiring custom builds.
YAMAGoya operates via both graphical and command-line interfaces, accommodating different operational preferences.
YAMAGoya’s Alert tab
Users can run Sigma rule monitoring or memory scanning with simple commands, provided they have administrative privileges.
JPCERT/CC detection alerts appear in the tool’s interface. They are logged to Windows Event Log with specific event IDs for integration with security information and event management (SIEM) systems.
This enables centralized monitoring and alerting across enterprise environments. By supporting industry-standard detection rules, YAMAGoya democratizes advanced threat detection capabilities.
JPCERT/CC researchers and incident responders can now leverage community-developed Sigma and YARA rules without vendor lock-in, strengthening the collective cybersecurity defense posture against emerging threats.
New release brings significant improvements to the penetration testing framework, introducing enhanced GUI features, REST API support, and powerful new evasion techniques that security researchers can leverage for offensive operations.
The latest release features a completely redesigned graphical interface with multiple theme options, including Dracula, Solarized, and Monokai.
All visualizations have been updated, including an improved Pivot Graph that now displays listener names and transition types for better infrastructure management.
Category
Feature
GUI & Interface
Modern redesigned client with Dracula, Solarized, Monokai themes
Updated Pivot Graph with listener names and pivot types
Java 17 minimum requirement
REST API
Script with any programming language (Beta)
Advanced automation and custom client development
ML/LLM integration support
Custom C2
User Defined Command and Control (UDC2)
Custom C2 channels via BOFs
ICMP and unconventional channel routing
Process Injection
RtlCloneUserProcess (DirtyVanity-based)
TpDirect (thread pool manipulation)
TpStartRoutineStub (thread pool triggering)
EarlyCascade (fork/run injection)
UAC Bypasses
uac-rpc-dom (AppInfo ALPC bypass)
uac-cmlua (ICMLuaUtil COM interface)
Windows 10–11 24H2 compatible
Memory Operations
BeaconDownload API (up to 2GB in-memory)
Drip loading for EDR evasion
No disk writes for sensitive data
Beacon Improvements
Sleepmask for pivot beacons
IPv6 SOCKS5 proxy support
Fixed SSH Beacon (Mac/Linux)
Task ID logging for operations
A significant change requires users to upgrade to Java 17 or newer. Earlier Java versions will no longer run the application, ensuring access to modern security features and improved performance.
Revolutionary REST API and Custom C2 Channels
For the first time, Cobalt Strike users can script the framework using any programming language through a new REST API (currently in beta).
This enables advanced automation, server-side operation storage, and the development of custom Cobalt Strike clients.
The REST API opens the door to integrating machine learning models into offensive workflows, in line with emerging research by security teams exploring AI-powered exploitation techniques.
The high-level architecture of UDC2
Additionally, User Defined Command and Control (UDC2) allows operators to develop custom C2 channels as Beacon Object Files (BOFs).
This eliminates previous limitations by enabling traffic to be routed through unconventional channels, such as ICMP, while maintaining compatibility with custom transformations and obfuscation methods.
Enhanced Process Injection and UAC Bypasses
Cobalt Strike 4.12 introduces four new process injection techniques designed to evade endpoint detection and response (EDR) systems.
These include RtlCloneUserProcess (based on DirtyVanity research), TpDirect, TpStartRoutineStub, and EarlyCascade, all implemented as BOFs for flexibility.
Two new UAC bypass methods, uac-rpc-dom and uac-cmlua, work across Windows 10 through Windows 11 24H2, providing reliable privilege escalation paths for tested environments.
A screenshot of the new Process Injection GUI with a custom technique
The BeaconDownload API now supports downloading in-memory buffers up to 2GB without writing files to disk, reducing analytical indicators.
Drip-loading functionality has been added to break event correlation by spreading payload writes with delays, thereby defeating detection logic based on injection-primitive sequences.
A screenshot showing the new UDRL-VS GUI
Pivot Beacons now support the Sleepmask evasion technology, and IPv6 support has been added for SOCKS5 proxying, expanding operational flexibility.
These updates position Cobalt Strike 4.12 as a comprehensive framework for modern red team operations and security research.
