Daily

daily@lists.cert.at

1 participants
3309 discussions

Tageszusammenfassung - 05.12.2025
by Daily end-of-shift report 05 Dec '25

05 Dec '25

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 04-12-2025 18:00 − Freitag 05-12-2025 18:00 Handler: Michael Schlagenhaufer Co-Handler: Alexander Riepl ===================== = News = ===================== ∗∗∗ React2Shell - Angriffe gegen verwundbare Anwendungen auf von Basis React.JS und weiterer Frameworks ∗∗∗ --------------------------------------------- Diese Woche wurden kritische Sicherheitslücken in den React Server Components veröffentlicht. Diese Schwachstellen ermöglichen unauthentifizierte Remote-Code Execution sofern Anwendungen die betroffenen Server Components einsetzen. Mittlerweile wird diese Sicherheitslücke aktiv ausgenutzt um verwundbare Installationen zu kompromittieren. Proof-of-Concept Exploits sind bereits öffentlich zugänglich. CVE-Nummer(n): CVE-2025-55182 --------------------------------------------- https://www.cert.at/de/warnungen/2025/12/react2shell-angriffe-gegen-verwund… ∗∗∗ CVE-2025-55182 (React2Shell) Opportunistic Exploitation In The Wild: What The GreyNoise Observation Grid Is Seeing So Far ∗∗∗ --------------------------------------------- GreyNoise is already seeing opportunistic, largely automated exploitation attempts consistent with the newly disclosed React Server Components (RSC) “Flight” protocol RCE—often referred to publicly as “React2Shell” and tracked as CVE-2025-55182. --------------------------------------------- https://www.greynoise.io/blog/cve-2025-55182-react2shell-opportunistic-expl… ∗∗∗ Cloudflare blames todays outage on emergency React2Shell patch ∗∗∗ --------------------------------------------- Cloudflare has blamed todays outage on the emergency patching of a critical React remote code execution vulnerability, which is now actively exploited in attacks. [..] "The issue was not caused, directly or indirectly, by a cyber attack on Cloudflare’s systems or malicious activity of any kind. Instead, it was triggered by changes being made to our body parsing logic while attempting to detect and mitigate an industry-wide vulnerability disclosed this week in React Server Components," Cloudflare CTO Dane Knecht noted in a post-mortem. --------------------------------------------- https://www.bleepingcomputer.com/news/security/cloudflare-blames-todays-out… ∗∗∗ Cybersecurity industry overreacts to React vulnerability, starts panic, burns own house down again ∗∗∗ --------------------------------------------- The disclosure write up is great — it’s full of facts, and explains when you are and aren’t vulnerable. I don’t think anybody knows how to parse it and people have started taking actions before even knowing what they’re doing. [..] Check with your developers and suppliers if they even use React v19 yet. They most probably don’t, in which case you aren’t vulnerable. --------------------------------------------- https://doublepulsar.com/cybersecurity-industry-overreacts-to-react-vulnera… ∗∗∗ Hackers are exploiting ArrayOS AG VPN flaw to plant webshells ∗∗∗ --------------------------------------------- Threat actors have been exploiting a command injection vulnerability in Array AG Series VPN devices to plant webshells and create rogue users. Array Networks fixed the vulnerability in a May security update, but has not assigned an identifier, complicating efforts to track the flaw and patch management. --------------------------------------------- https://www.bleepingcomputer.com/news/security/hackers-are-exploiting-array… ∗∗∗ FBI warns of virtual kidnapping scams using altered social media photos ∗∗∗ --------------------------------------------- The FBI warns that criminals are altering images shared on social media and using them as fake proof of life photos in virtual kidnapping ransom scams. --------------------------------------------- https://www.bleepingcomputer.com/news/security/fbi-warns-of-virtual-kidnapp… ∗∗∗ Asus supplier hit by ransomware attack as gang flaunts alleged 1 TB haul ∗∗∗ --------------------------------------------- Laptop maker says a vendor breach exposed some phone camera code, but not its own systems Asus has admitted that a third-party supplier was popped by cybercrims after the Everest ransomware gang claimed it had rifled through the tech titans internal files. --------------------------------------------- https://go.theregister.com/feed/www.theregister.com/2025/12/05/asus_supplie… ∗∗∗ SMS Phishers Pivot to Points, Taxes, Fake Retailers ∗∗∗ --------------------------------------------- Over the past week, thousands of domain names were registered for scam websites that purport to offer T-Mobile customers the opportunity to claim a large number of rewards points. The phishing domains are being promoted by scam messages sent via Apple’s iMessage service or the functionally equivalent RCS messaging service built into Google phones. --------------------------------------------- https://krebsonsecurity.com/2025/12/sms-phishers-pivot-to-points-taxes-fake… ∗∗∗ Warnung: Neue Phishing-E-Mails im Namen der WKO im Umlauf ∗∗∗ --------------------------------------------- Kriminelle imitieren besonders gern bekannte Organisationen. Aktuell ist erneut die WKO betroffen. Bei einer neuen Phishing-Variante werden Empfänger:innen unter dem Vorwand einer „Qualitätssicherung“ dazu aufgefordert, ihre Daten zu überprüfen. --------------------------------------------- https://www.watchlist-internet.at/news/wko-phishing-e-mails-datenerfassung/ ∗∗∗ A Hidden Pattern Within Months of Credential-Based Attacks Against Palo Alto GlobalProtect ∗∗∗ --------------------------------------------- GreyNoise detected a surge of 7,000+ IPs attempting to log into GlobalProtect, sharing fingerprints with a surge in SonicWall API scanning and earlier Palo Alto campaigns, exposing a persistent credential-based attack pattern. --------------------------------------------- https://www.greynoise.io/blog/hidden-pattern-credential-based-attacks-palo-… ∗∗∗ November CVEs Fell 25% YoY, Driven by Slowdowns at Major CNAs ∗∗∗ --------------------------------------------- 2025 CVE volume is still running ahead of 2024 overall, even as November cooled off year over year. [..] For security teams, the practical takeaway is to be careful about using “global CVE count” as a proxy for risk. CVE volume can still be useful as a publishing health signal, especially when concentrated among a small number of high-output CNAs and programs. --------------------------------------------- https://socket.dev/blog/november-cves-fell-25-yoy-driven-by-slowdowns-at-ma… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (buildah, firefox, gimp:2.8, go-toolset:rhel8, ipa, kea, kernel, kernel-rt, pcs, qt6-qtquick3d, qt6-qtsvg, systemd, and valkey), Debian (chromium and unbound), Fedora (alexvsbus, CuraEngine, fcgi, libcoap, python-kdcproxy, texlive-base, timg, and xpdf), Mageia (digikam, darktable, libraw, gnutls, python-django, unbound, webkit2, and xkbcomp), Oracle (bind, firefox, gimp:2.8, haproxy, ipa, java-25-openjdk, kea, kernel, libsoup3, libssh, libtiff, openssl, podman, qt6-qtsvg, squid, systemd, vim, and xorg-x11-server-Xwayland), Slackware (httpd and libpng), SUSE (chromedriver, kernel, and python-mistralclient), and Ubuntu (cups, linux-azure, linux-gcp, linux-gcp, linux-gke, linux-gkeop, linux-ibm-6.8, linux-iot, and mame). --------------------------------------------- https://lwn.net/Articles/1049417/ ∗∗∗ VU#441887: Duc contains a stack buffer overflow vulnerability in the buffer_get function, allowing for out-of-bounds memory read ∗∗∗ --------------------------------------------- https://kb.cert.org/vuls/id/441887 ∗∗∗ Drupal: Security advisories for contributed projects ∗∗∗ --------------------------------------------- https://www.drupal.org/security/contrib ∗∗∗ Socomec DIRIS Digiware M series and Easy Config, PDF XChange Editor vulnerabilities ∗∗∗ --------------------------------------------- https://blog.talosintelligence.com/socomec-diris-digiware-m-series-and-easy… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 04.12.2025
by Daily end-of-shift report 04 Dec '25

04 Dec '25

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 03-12-2025 18:30 − Donnerstag 04-12-2025 18:30 Handler: Michael Schlagenhaufer Co-Handler: Guenes Holler ===================== = News = ===================== ∗∗∗ Fraudulent gambling network may be a nation-state spying operation ∗∗∗ --------------------------------------------- A sprawling infrastructure that has been bilking unsuspecting people through fraudulent gambling websites for 14 years is likely a dual operation run by a nation-state-sponsored group that is targeting government and private-industry organizations in the US and Europe, researchers said Wednesday. --------------------------------------------- https://arstechnica.com/security/2025/12/fraudulent-gambling-network-may-be… ∗∗∗ Sparkurs bei MacOS: Apple verärgert Forscher mit gekürzten Bug-Bounty-Prämien ∗∗∗ --------------------------------------------- Forscher, die Sicherheitslücken in dem Apple-Betriebssystem MacOS erkunden und an den Hersteller melden, erhalten dafür künftig geringere Belohnungen. Darauf machte kürzlich der Sicherheitsforscher Csaba Fitzl in einem Beitrag auf Linkedin aufmerksam. Er wirft Apple vor, MacOS mit diesem Schritt abzuwerten und sich nicht mehr für den Datenschutz der Nutzer zu interessieren. --------------------------------------------- https://www.golem.de/news/macos-apple-veraergert-forscher-mit-gekuerzten-bu… ∗∗∗ Attempts to Bypass CDNs, (Wed, Dec 3rd) ∗∗∗ --------------------------------------------- Currently, in order to provide basic DDoS protection and filter aggressive bots, some form of Content Delivery Network (CDN) is usually the simplest and most cost-effective way to protect a web application. In a typical setup, DNS is used to point clients to the CDN, and the CDN will then forward the request to the actual web server. There are a number of companies offering services like this, and cloud providers will usually have solutions like this as well. --------------------------------------------- https://isc.sans.edu/diary/rss/32532 ∗∗∗ Nation-State Attack or Compromised Government? [Guest Diary], (Thu, Dec 4th) ∗∗∗ --------------------------------------------- The ISC internship didn't just teach me about security, it changed how I thought about threats entirely. There's something intriguing about watching live attacks materialize on your DShield Honeypot, knowing that somewhere across the world, an attacker just made a move. And the feedback loop of writing detailed attack observations, then having experienced analysts critique and refine your analysis? That's where real learning happens. One attack observation in particular stands out as a perfect example of what makes this internship so powerful. Let me show you what I discovered! --------------------------------------------- https://isc.sans.edu/diary/rss/32536 ∗∗∗ Record 29.7 Tbps DDoS Attack Linked to AISURU Botnet with up to 4 Million Infected Hosts ∗∗∗ --------------------------------------------- The botnet has prominently targeted telecommunication providers, gaming companies, hosting providers, and financial services. Also tackled by Cloudflare was a 14.1 Bpps DDoS attack from the same botnet. AISURU is believed to be powered by a massive network comprising an estimated 1-4 million infected hosts worldwide. --------------------------------------------- https://thehackernews.com/2025/12/record-297-tbps-ddos-attack-linked-to.html ∗∗∗ Gartenfreude oder Betrugsfalle? Warnung vor betrügerischen Pflanzenshops ∗∗∗ --------------------------------------------- Der Beginn des Winters ist einer der besten Zeitpunkte, um Obstbäume zu pflanzen. Das wissen nicht nur Gartenfreund:innen, sondern leider auch Kriminelle. Immer mehr Fake-Shops locken mit vermeintlich attraktiven Angeboten und führen Konsument:innen in die Falle. --------------------------------------------- https://www.watchlist-internet.at/news/warnung-vor-betruegerischen-pflanzen… ∗∗∗ BRICKSTORM Backdoor ∗∗∗ --------------------------------------------- The Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), and Canadian Centre for Cyber Security (Cyber Centre) assess People’s Republic of China (PRC) state-sponsored cyber actors are using BRICKSTORM malware for long-term persistence on victim systems. CISA, NSA, and Cyber Centre are releasing this Malware Analysis Report to share indicators of compromise (IOCs) and detection signatures based off analysis of eight BRICKSTORM samples. CISA, NSA, and Cyber Centre urge organizations to use the IOCs and detection signatures to identify BRICKSTORM malware samples. --------------------------------------------- https://www.cisa.gov/news-events/analysis-reports/ar25-338a ∗∗∗ ValleyRAT Campaign Targets Job Seekers, Abuses Foxit PDF Reader for DLL Side-loading ∗∗∗ --------------------------------------------- Job seekers looking out for opportunities might instead find their personal devices compromised, as a ValleyRAT campaign propagated through email leverages Foxit PDF Reader for concealment and DLL side-loading for initial entry. --------------------------------------------- https://www.trendmicro.com/en_us/research/25/l/valleyrat-campaign.html ∗∗∗ Fake ChatGPT Atlas Browser Used in ClickFix Attack to Steal Passwords ∗∗∗ --------------------------------------------- Cybersecurity researchers have uncovered a critical ChatGPT Atlas browser attack, confirming the danger of the ongoing surge in the ClickFix threat. --------------------------------------------- https://hackread.com/fake-chatgpt-atlas-clickfix-steal-passwords/ ∗∗∗ Sanctioned but Still Spying: Intellexa’s Prolific Zero-Day Exploits Continue ∗∗∗ --------------------------------------------- Despite extensive scrutiny and public reporting, commercial surveillance vendors continue to operate unimpeded. A prominent name continues to surface in the world of mercenary spyware, Intellexa. Known for its “Predator” spyware, the company was sanctioned by the US Government. New Google Threat Intelligence Group (GTIG) analysis shows that Intellexa is evading restrictions and thriving. --------------------------------------------- https://cloud.google.com/blog/topics/threat-intelligence/intellexa-zero-day… ∗∗∗ New Stealthy Linux Malware Combines Mirai DDoS Botnet with Cryptominer ∗∗∗ --------------------------------------------- Cyble researchers have identified new Linux malware that combines Mirai-derived DDoS botnet capabilities with a stealthy fileless cryptominer, enabling both network disruption and financial profit in the same threat campaign. --------------------------------------------- https://thecyberexpress.com/linux-malware-mirai-botnet-cryptominer/ ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (expat and libxml2), Debian (openvpn and webkit2gtk), Fedora (gi-loadouts, kf6-kcoreaddons, kf6-kguiaddons, kf6-kjobwidgets, kf6-knotifications, kf6-kstatusnotifieritem, kf6-kunitconversion, kf6-kwidgetsaddons, kf6-kxmlgui, nanovna-saver, persepolis, python-ezdxf, python-pyside6, sigil, stb, syncplay, tinyproxy, torbrowser-launcher, ubertooth, and usd), Mageia (cups), SUSE (cups, gegl, icinga2, mozjs128, and Security), and Ubuntu (ghostscript, kernel, linux, linux-aws, linux-aws-5.15, linux-gcp-5.15, linux-hwe-5.15, linux-ibm, linux-ibm-5.15, linux-intel-iotg, linux-intel-iotg-5.15, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, linux-nvidia-tegra, linux-nvidia-tegra-5.15, linux-nvidia-tegra-igx, linux-oracle, linux-oracle-5.15, linux-xilinx-zynqmp, linux, linux-aws, linux-aws-hwe, linux-kvm, linux-oracle, linux-aws-fips, linux-fips, linux-aws-fips, linux-fips, linux-gcp-fips, linux-azure-fips, linux-gcp, linux-gcp-4.15, linux-hwe, linux-gcp, linux-gcp-6.8, linux-gke, linux-gkeop, linux-gcp-6.14, linux-raspi, linux-gcp-fips, linux-intel-iot-realtime, linux-realtime, linux-raspi, linux-raspi-realtime, linux-xilinx, and postgresql-14, postgresql-16, postgresql-17). --------------------------------------------- https://lwn.net/Articles/1049251/ ∗∗∗ Cross-Site Scripting in Nextcloud: Development files shipped in files_pdfviewer app ∗∗∗ --------------------------------------------- Nextcloud’s PDF viewer uses an outdated version of PDF.js vulnerable to CVE-2024-4367. Attackers with regular user access to a Nextcloud instance are able to prepare a special link. If this link is visited by other logged-in users a cross-site scripting is executed and attackers get access to that users’ files. --------------------------------------------- https://www.redteam-pentesting.de/en/advisories/rt-sa-2025-003/ ∗∗∗ Jetzt patchen! Kritische Schadcodelücke bedroht React ∗∗∗ --------------------------------------------- Softwareentwickler, die mit React arbeiten, sollten die JavaScript-Programmbibliothek aus Sicherheitsgründen umgehend auf den aktuellen Stand bringen. Geschieht das nicht, können Angreifer eine Schwachstelle ausnutzen und Systeme durch das Ausführen von Schadcode vollständig kompromittieren. Sicherheitsupdates sind verfügbar. --------------------------------------------- https://heise.de/-11102366 ∗∗∗ Chrome 143.0.7499.40 / 41 schließt Schwachstellen ∗∗∗ --------------------------------------------- Zum 2. Dezember 2025 hat Google den Chrome-Browser auf die Versionen 143.0.7499.40 / 41 aktualisiert, um gleich mehrere Schwachstellen zu schließen. Auch der Extended Stable Chromium-Entwicklungszweig hat ein Update erhalten. Ich ziehe mal einige Informationen zu diesen Themen nachfolgend kurz zusammen. --------------------------------------------- https://www.borncity.com/blog/2025/12/04/chrome-143-0-7499-40-41-schliesst-… ∗∗∗ DSA-6069-1 openvpn - security update ∗∗∗ --------------------------------------------- https://lists.debian.org/debian-security-announce/2025/msg00235.html ∗∗∗ K000158050: SQLite vulnerability CVE-2019-8457 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000158050 ∗∗∗ K000158042: Apache HTTP server vulnerabilities CVE-2024-47252 and CVE-2025-49812 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000158042 ∗∗∗ K000158059: Next.js vulnerability CVE-2025-66478 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000158059 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 03.12.2025
by Daily end-of-shift report 03 Dec '25

03 Dec '25

===================== = End-of-Day report = ===================== Timeframe: Dienstag 02-12-2025 18:00 − Mittwoch 03-12-2025 18:30 Handler: Michael Schlagenhaufer Co-Handler: Felician Fuchs ===================== = News = ===================== ∗∗∗ Aisuru botnet behind new record-breaking 29.7 Tbps DDoS attack ∗∗∗ --------------------------------------------- In just three months, the massive Aisuru botnet launched more than 1,300 distributed denial-of-service attacks, one of them setting a new record with a peak at 29.7 terabits per second. --------------------------------------------- https://www.bleepingcomputer.com/news/security/aisuru-botnet-behind-new-rec… ∗∗∗ Deep dive into DragonForce ransomware and its Scattered Spider connection ∗∗∗ --------------------------------------------- DragonForce expanded its ransomware operation in 2025 by working with English-speaking hackers known for advanced social engineering and initial access. Acronis explains how the "Scattered Spider" collaboration enables coordinated, multistage intrusions across major environments. --------------------------------------------- https://www.bleepingcomputer.com/news/security/deep-dive-into-dragonforce-r… ∗∗∗ Technical Analysis of Matanbuchus 3.0 ∗∗∗ --------------------------------------------- Matanbuchus is a malicious downloader, written in C++, which has been offered as a Malware-as-a-Service (MaaS) since 2020. Over this time, Matanbuchus has undergone several development stages. In July 2025, version 3.0 of Matanbuchus was identified in-the-wild. Matanbuchus offers threat actors the option to deploy additional payloads and perform hands-on keyboard activity via shell commands. --------------------------------------------- https://www.zscaler.com/blogs/security-research/technical-analysis-matanbuc… ∗∗∗ Grundrechte: Gericht stoppt Massenüberwachung des Schweizer Geheimdienstes ∗∗∗ --------------------------------------------- Das Schweizer Bundesverwaltungsgericht erklärt die Fernmeldeaufklärung des Nachrichtendienstes des Bundes nach Klage von Bürgerrechtlern für verfassungswidrig. --------------------------------------------- https://www.heise.de/news/Grundrechte-Gericht-stoppt-Massenueberwachung-des… ∗∗∗ Falsche Schlangen: Neues von MuddyWater ∗∗∗ --------------------------------------------- MuddyWater hat es auf kritische Infrastrukturen in Israel und Ägypten abgesehen und setzt dabei auf maßgeschneiderte Malware, verbesserte Taktiken und ein vorhersehbares Spielbuch. --------------------------------------------- https://www.welivesecurity.com/de/eset-research/falsche-schlangen-neues-von… ∗∗∗ Aktuelle Welle: Phishing im Namen der Volksbank ∗∗∗ --------------------------------------------- Seit einigen Wochen versenden Kriminelle ihre Phishing-Versuche besonders häufig im Namen der Volksbank. Sie setzen dabei auf die altbekannten E-Mails bzw. SMS-Nachrichten. Wer dem Link zur „Datenaktualisierung“ oder „Konto-Entsperrung“ folgt, läuft Gefahr, Logindaten für Onlinebanking preiszugeben. --------------------------------------------- https://www.watchlist-internet.at/news/starke-welle-phishing-volksbank/ ∗∗∗ India backs off mandatory cyber safety app after surveillance backlash ∗∗∗ --------------------------------------------- Mobile phone makers will no longer be required to load the Indian governments Sanchar Saathi app onto new devices after the initial announcement prompted pushback from companies and privacy groups. --------------------------------------------- https://therecord.media/india-drops-mandate-sanchar-saathi-app-privacy-surv… ∗∗∗ Small numbers of Notepad++ users reporting security woes ∗∗∗ --------------------------------------------- I’ve heard from 3 orgs now who’ve had security incidents on boxes with Notepad++ installed, where it appears Notepad++ processes have spawned the initial access. These have resulted in hands on keyboard threat actors. --------------------------------------------- https://doublepulsar.com/small-numbers-of-notepad-users-reporting-security-… ∗∗∗ Everest Ransomware Claims ASUS Breach and 1TB Data Theft ∗∗∗ --------------------------------------------- Everest ransomware group claims it breached ASUS, stealing over 1TB of data including camera source code. ASUS has been given 21 hours to respond via Qtox. --------------------------------------------- https://hackread.com/everest-ransomware-asus-breach-1tb-data/ ∗∗∗ Paying the Ransom: A Short-Term Fix or Long-Term Risks? ∗∗∗ --------------------------------------------- Ransomware attacks rose by nearly 25% in 2024. If compromised, should you pay ransomware demands or not? We review the risks, reasons to pay or not, and more. --------------------------------------------- https://www.bitsight.com/blog/paying-ransom-for-ransomware ∗∗∗ Industrielle Kontrollsysteme: Iskra iHUB bleibt vorerst ohne Sicherheitspatch ∗∗∗ --------------------------------------------- Für einige industrielle Steuerungs- und Automatisierungssysteme von etwa Mitsubishi sind Sicherheitsupdates erschienen. Eine kritische Lücke bleibt aber offen. --------------------------------------------- https://heise.de/-11101017 ===================== = Vulnerabilities = ===================== ∗∗∗ Vulnerability & Patch Roundup — November 2025 ∗∗∗ --------------------------------------------- Vulnerability reports and responsible disclosures are essential for website security awareness and education. Automated attacks targeting known software vulnerabilities are one of the leading causes of website compromises. To help educate website owners about potential threats to their environments, we’ve compiled a list of important security updates and vulnerability patches for the WordPress ecosystem this past month. --------------------------------------------- https://blog.sucuri.net/2025/11/vulnerability-patch-roundup-november-2025.h… ∗∗∗ 100,000 WordPress Sites Affected by Remote Code Execution Vulnerability in Advanced Custom Fields: Extended WordPress Plugin ∗∗∗ --------------------------------------------- On November 18th, 2025, we received a submission for an unauthenticated Remote Code Execution vulnerability in Advanced Custom Fields: Extended, a WordPress plugin with more than 100,000 active installations. This vulnerability can be leveraged to execute code remotely. --------------------------------------------- https://www.wordfence.com/blog/2025/12/100000-wordpress-sites-affected-by-r… ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (containerd, mako, and xen), Fedora (forgejo, nextcloud, openbao, rclone, restic, and tigervnc), Oracle (firefox, kernel, libtiff, libxml2, and postgresql), SUSE (libecpg6, lightdm-kde-greeter, python-cbor2, python-mistralclient-doc, python315, and python39), and Ubuntu (kdeconnect, linux, linux-aws, linux-realtime, python-django, and unbound). --------------------------------------------- https://lwn.net/Articles/1049103/ ∗∗∗ Microsoft schließt stillschweigend LNK-Schwachstelle CVE-2025-9491 ∗∗∗ --------------------------------------------- Seit Ende August 2025 ist eine LNK-File-Schwachstelle (CVE-2025-9491) bekannt. Diese lässt sich unter Windows für eine Remote Code-Ausführung missbrauchen. Microsoft wollte erst keinen Patch bereitstellen, hat dann aber doch was per Update getan. --------------------------------------------- https://www.borncity.com/blog/2025/12/03/microsoft-schliesst-stillschweigen… ∗∗∗ CISA Releases Five Industrial Control Systems Advisories ∗∗∗ --------------------------------------------- CISA released five Industrial Control Systems (ICS) Advisories. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-336-01 Industrial Video & Control LongwatchICSA-25-336-02 Iskra iHUB and iHUB Lite. ICSMA-25-336-01 Mirion Medical EC2 Software NMIS BioDose. ICSA-25-201-01 Mitsubishi Electric CNC Series (Update A) and ICSA-23-157-02 Mitsubishi Electric MELSEC iQ-R Series/iQ-F Series (Update C). --------------------------------------------- https://www.cisa.gov/news-events/alerts/2025/12/02/cisa-releases-five-indus… ∗∗∗ ZDI-25-1039: (Pwn2Own) Synology BeeStation Plus auth_info Stack-based Buffer Overflow Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-25-1039/ ∗∗∗ Splunk SVD-2025-1209: Third-Party Package Updates in Splunk Enterprise - December 2025 ∗∗∗ --------------------------------------------- https://advisory.splunk.com//advisories/SVD-2025-1209 ∗∗∗ Splunk SVD-2025-1206: Incorrect permissions assignment on Splunk Universal Forwarder for Windows during new installation or upgrade ∗∗∗ --------------------------------------------- https://advisory.splunk.com//advisories/SVD-2025-1206 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 02.12.2025
by Daily end-of-shift report 02 Dec '25

02 Dec '25

===================== = End-of-Day report = ===================== Timeframe: Montag 01-12-2025 18:00 − Dienstag 02-12-2025 18:00 Handler: Felician Fuchs Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Glassworm malware returns in third wave of malicious VS Code packages ∗∗∗ --------------------------------------------- The Glassworm campaign, which first emerged on the OpenVSX and Microsoft Visual Studio marketplaces in October, is now in its third wave, with 24 new packages added on the two platforms. --------------------------------------------- https://www.bleepingcomputer.com/news/security/glassworm-malware-returns-in… ∗∗∗ [Guest Diary] Hunting for SharePoint In-Memory ToolShell Payloads, (Tue, Dec 2nd) ∗∗∗ --------------------------------------------- In July 2025, many of us were introduced to the Microsoft SharePoint exploit chain known as ToolShell. ToolShell exploits the deserialization and authentication bypass vulnerabilities, CVE-2025-53770 [2] and CVE-2025-53771 [3], in on-premises SharePoint Server 2016, 2019, and Subscription editions. --------------------------------------------- https://isc.sans.edu/diary/rss/32524 ∗∗∗ Iran-Linked Hackers Hits Israeli Sectors with New MuddyViper Backdoor in Targeted Attacks ∗∗∗ --------------------------------------------- Israeli entities spanning academia, engineering, local government, manufacturing, technology, transportation, and utilities sectors have emerged as the target of a new set of attacks undertaken by Iranian nation-state actors that have delivered a previously undocumented backdoor called MuddyViper. --------------------------------------------- https://thehackernews.com/2025/12/iran-linked-hackers-hits-israeli_2.html ∗∗∗ Stealthy browser extensions waited years before infecting 4.3M Chrome, Edge users with backdoors and spyware ∗∗∗ --------------------------------------------- And some are still active in the Microsoft Edge store A seven-year malicious browser extension campaign infected 4.3 million Google Chrome and Microsoft Edge users with malware, including backdoors and spyware sending peoples data to servers in China. --------------------------------------------- https://www.theregister.com/2025/12/01/chrome_edge_malicious_browser_extens… ∗∗∗ Dont say "Jehova" to an LLM ∗∗∗ --------------------------------------------- The Rabbi in the old skit from Monty Python's "Life of Brian" fell for it, and for a long time, philosophers argued whether quoting someone is fundamentally different to just saying the sentence. I remember a story where one actor smuggled a wedding promise in a co-actor's copy of his lines: After the vow was made on the set and the sentence couldn't be found in the official script: is the actor now bound in real life by his promise? --------------------------------------------- https://www.cert.at/en/blog/2025/12/dont-say-jehova-to-an-llm ∗∗∗ Proxyearth Tool Lets Anyone Trace Users in India with Just a Mobile Number ∗∗∗ --------------------------------------------- Proxyearth is a new site that shows names, Aadhaar numbers, and live locations of users in India using only mobile numbers, raising serious privacy and security concerns. --------------------------------------------- https://hackread.com/proxyearth-trace-users-india-mobile-number/ ∗∗∗ Android TV: YouTube-Client SmartTube war mit Malware verseucht ∗∗∗ --------------------------------------------- Unbekannte konnten SmartTube mit Malware verseuchen und die Version kurzzeitig in Umlauf bringen. Nun gibt der Entwickler Einblicke zum Vorfall. --------------------------------------------- https://heise.de/-11099310 ∗∗∗ Shai-Hulud 2.0 Aftermath: Trends, Victimology and Impact ∗∗∗ --------------------------------------------- A deeper look at the Shai-Hulud 2.0 supply chain attack: reviewing the infection spread, victimology, leaked secrets distribution, and community response so far. --------------------------------------------- https://www.wiz.io/blog/shai-hulud-2-0-aftermath-ongoing-supply-chain-attack ∗∗∗ 68% Of Phishing Websites Are Protected by CloudFlare ∗∗∗ --------------------------------------------- Earlier this year, our CTI team set out to build something wed been thinking about for a while: a phishing intelligence pipeline that could actually keep up with the threat. We combined feeds from hundreds of independent sources with our own real-time hunt for suspicious SSL/TLS certificates. --------------------------------------------- https://blog.sicuranext.com/68-of-phishing-websites-are-protected-by-cloudf… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Fedora (gnutls, libpng, mingw-python3, python-spotipy, source-to-image, unbound, and webkitgtk), Mageia (libpng), SUSE (bash-git-prompt, gitea-tea, java-17-openjdk, java-21-openjdk, kernel, openssh, python, and shadowsocks-v2ray-plugin, v2ray-core), and Ubuntu (binutils, openjdk-17-crac, openjdk-21-crac, and openjdk-25-crac). --------------------------------------------- https://lwn.net/Articles/1048973/ ∗∗∗ Patchday: Attacken auf Geräte mit Android 13, 14, 15 und 16 beobachtet ∗∗∗ --------------------------------------------- Es sind wichtige Sicherheitsupdates für verschiedene Androidversionen erschienen. Es gibt bereits Attacken. --------------------------------------------- https://heise.de/-11099576 ∗∗∗ Qualcomm Issues Critical Security Alert Over Secure Boot Vulnerability ∗∗∗ --------------------------------------------- Qualcomm warned partners and device manufacturers about multiple newly discovered vulnerabilities that span its chipset ecosystem. The Qualcomm released a detailed security bulletin on December 1, 2025, outlining six high-priority weaknesses in its proprietary software, including one flaw that directly compromises the secure boot process, one of the most sensitive stages in a device’s startup chain. --------------------------------------------- https://thecyberexpress.com/qualcomm-2025-security-alert/ ∗∗∗ Critical SQL Injection Flaw Exposes Sensitive Data in Devolutions Server ∗∗∗ --------------------------------------------- A batch of new vulnerabilities in Devolutions Server targets organizations that depend on the platform to manage privileged accounts, passwords, and sensitive authentication data. Devolutions has released a security advisory, identified as DEVO-2025-0018, warning customers of multiple vulnerabilities, including a critical flaw that could enable attackers to extract confidential data directly from the system’s database. --------------------------------------------- https://thecyberexpress.com/devolutions-server-sql-injection-flaw/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 01.12.2025
by Daily end-of-shift report 01 Dec '25

01 Dec '25

===================== = End-of-Day report = ===================== Timeframe: Freitag 28-11-2025 18:00 − Montag 01-12-2025 18:00 Handler: Felician Fuchs Co-Handler: Guenes Holler ===================== = News = ===================== ∗∗∗ Arkanix Stealer: Newly discovered short term profit malware ∗∗∗ --------------------------------------------- Recently, we stumbled upon a new stealer named Arkanix. This stealer possibly belongs to the short-lived category of stealers which aim for short-term quick financial gains. --------------------------------------------- https://feeds.feedblitz.com/~/930747470/0/gdatasecurityblog-en~Arkanix-Stea… ∗∗∗ Bis zu 16 Jahre alt: Zehntausende gültige Zugangsdaten bei Gitlab geleakt ∗∗∗ --------------------------------------------- Ein Forscher hat alle öffentlichen Gitlab-Repos auf Zugangsdaten gescannt. Er fand mehr als 17.000, erhielt aber nur eine recht dürftige Belohnung. --------------------------------------------- https://www.golem.de/news/bis-zu-16-jahre-alt-zehntausende-gueltige-zugangs… ∗∗∗ North Korean Hackers Deploy 197 npm Packages to Spread Updated OtterCookie Malware ∗∗∗ --------------------------------------------- The North Korean threat actors behind the Contagious Interview campaign have continued to flood the npm registry with 197 more malicious packages since last month. --------------------------------------------- https://thehackernews.com/2025/11/north-korean-hackers-deploy-197-npm.html ∗∗∗ New Albiriox MaaS Malware Targets 400+ Apps for On-Device Fraud and Screen Control ∗∗∗ --------------------------------------------- A new Android malware named Albiriox has been advertised under a malware-as-a-service (MaaS) model to offer a "full spectrum" of features to facilitate on-device fraud (ODF), screen manipulation, and real-time interaction with infected devices. --------------------------------------------- https://thehackernews.com/2025/12/new-albiriox-maas-malware-targets-400.html ∗∗∗ Google and Apple ordered to stop fake government TXTs ∗∗∗ --------------------------------------------- Singapore’s government last week told Google and Apple to prevent fake government messages. --------------------------------------------- https://go.theregister.com/feed/www.theregister.com/2025/12/01/asia_tech_ne… ∗∗∗ The WIRED Guide to Digital Opsec for Teens ∗∗∗ --------------------------------------------- Practicing good “operations security” is essential to staying safe online. Here’s a complete guide for teenagers (and anyone else) who wants to button up their digital lives. --------------------------------------------- https://www.wired.com/story/digital-opsec-for-teens/ ∗∗∗ how i found a europa.eu compromise (thanks to cricket) ∗∗∗ --------------------------------------------- While looking for a way to stream the India vs Pakistan cricket match on 14th September 2025, I stumbled across a suspicious search result on a europa.eu dev subdomain. It was being abused for blackhat SEO and redirecting users to scam streaming sites. I traced similar behavior across other high-profile domains, reported the issue to CERT-EU via email (after some Twitter help) and the problem was later confirmed as fixed on 6th November 2025. This post walks through how I found it, how I reported it and what we can learn from it. --------------------------------------------- https://blog.himanshuanand.com/2025/11/how-i-found-a-europa.eu-compromise-t… ∗∗∗ Südkorea: Bei Onlinehändler Daten zu zwei Dritteln der Bevölkerung abgegriffen ∗∗∗ --------------------------------------------- Ein inzwischen nicht mehr bei Coupang arbeitender Angestellter soll bei Südkoreas größtem Onlinehändler Daten zur gesamten Kundschaft abgegriffen haben. --------------------------------------------- https://www.heise.de/news/Suedkorea-Bei-Onlinehaendler-Daten-zu-zwei-Dritte… ∗∗∗ Webinar: Smartphone, Tablet & Co sicher nutzen ∗∗∗ --------------------------------------------- Wie kann ich meine persönlichen Daten am Smartphone, Tablet & Co. schützen? Wie erkenne ich Viren und Trojaner auf meinem Gerät - und was ist dann zu tun? In diesem Webinar zeigen wir Ihnen die wichtigsten Sicherheitseinstellungen – von Berechtigungen über Datenschutz bis hin zu Nutzungszeiten. --------------------------------------------- https://www.watchlist-internet.at/news/webinar-smartphone-tablet-co-sicher-… ∗∗∗ Fußballtrikots zum Schnäppchenpreis? Bei diesen Fake-Shops gibt es nur Eigentore ∗∗∗ --------------------------------------------- Fußballspieler:innen aufgepasst! Gerade wimmelt es von Fake-Shops mit günstigen Trikots. --------------------------------------------- https://www.watchlist-internet.at/news/fussballtrikots-zum-schnaeppchenprei… ∗∗∗ Awareness für Web-Security: Die OWASP Top Ten 2025 ∗∗∗ --------------------------------------------- Der erste Release Candidate der neuen OWASP Top Ten enthüllt die größten Sicherheitsrisiken in der Webentwicklung – von Konfiguration bis Software Supply Chain. --------------------------------------------- https://heise.de/-11098119 ∗∗∗ India Enforces Mandatory SIM-Binding for Messaging Apps Under New DoT Rules ∗∗∗ --------------------------------------------- India’s Department of Telecommunications (DoT) has introduced a shift in the way messaging platforms operate in the country, mandating the adoption of SIM-binding as a core security requirement. Under the Telecommunication Cybersecurity Amendment Rules, 2025, all major messaging services, including Telegram, and regional platforms such as Arattai, must ensure that their applications remain continuously linked to an active SIM card on the user’s device. --------------------------------------------- https://thecyberexpress.com/sim-binding-dot-rule/ ===================== = Vulnerabilities = ===================== ∗∗∗ VU#633103: Insufficient Session Cookie Invalidation in nopCommerce ASP.NET Core eCommerce Platform ∗∗∗ --------------------------------------------- nopCommerce, an ecommerce platform, fails to invalidate session cookies upon user logout or session termination, enabling attackers to use the captured cookie to gain access to the application. Version 4.70 and after, with the exception of 4.80.3, fixes the vulnerability put forth by CVE-2025-11699. Users on version 4.80.3, or any version of nopCommerce prior to version 4.70, should update to the latest version, 4.90.3, as soon as possible. --------------------------------------------- https://kb.cert.org/vuls/id/633103 ∗∗∗ CISA Adds Actively Exploited XSS Bug CVE-2021-26829 in OpenPLC ScadaBR to KEV ∗∗∗ --------------------------------------------- The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has updated its Known Exploited Vulnerabilities (KEV) catalog to include a security flaw impacting OpenPLC ScadaBR, citing evidence of active exploitation. --------------------------------------------- https://thehackernews.com/2025/11/cisa-adds-actively-exploited-xss-bug.html ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (bind9.18, cups, gimp, ipa, kernel, libssh, mingw-expat, openssl, pcs, sssd, tigervnc, and valkey), Debian (gnome-shell-extension-gsconnect, mistral-dashboard, pagure, python-mistralclient, pytorch, qtbase-opensource-src, sogo, tryton-server, and unbound), Fedora (cef, drupal7, glib2, linux-firmware, migrate, pack, pgadmin4, rnp, and unbound), Slackware (libxslt), SUSE (cpp-httplib, curl, glib2, grub2, kernel, libcoap-devel, libcryptopp, libwireshark19, postgresql15, and postgresql17), and Ubuntu (edk2). --------------------------------------------- https://lwn.net/Articles/1048817/ ∗∗∗ Sicherheitsupdate: Präparierte XML-Dateien können GeoServer lahmlegen ∗∗∗ --------------------------------------------- Nutzen Angreifer erfolgreich Schwachstellen in GeoServer aus, können sie unter anderem Schadcode ausführen. In aktuellen Versionen haben die Entwickler nun die Sicherheitsprobleme gelöst. --------------------------------------------- https://heise.de/-11097923 ∗∗∗ Microsoft Entra ID blockt externe Fremd-Scripte ∗∗∗ --------------------------------------------- Kleiner Nachtrag von letzter Woche, der Administratoren in Unternehmensumgebungen tangieren kann. Microsoft will die Sicherheit der Microsoft Entra ID-Authentifizierung verbessern. Dazu sollen indem externe Skriptinjektionen blockiert werden, wie ein Entwickler in einem Blog-Beitrag im Microsoft Entra-Blog erklärt hat. --------------------------------------------- https://www.borncity.com/blog/2025/12/01/microsoft-entra-id-blockt-externe-… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 28.11.2025
by Daily end-of-shift report 28 Nov '25

28 Nov '25

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 27-11-2025 18:00 − Freitag 28-11-2025 18:00 Handler: Felician Fuchs Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Malicious LLMs empower inexperienced hackers with advanced tools ∗∗∗ --------------------------------------------- Unrestricted large language models (LLMs) like WormGPT 4 and KawaiiGPT are improving their capabilities to generate malicious code, delivering functional scripts for ransomware encryptors and lateral movement. --------------------------------------------- https://www.bleepingcomputer.com/news/security/malicious-llms-empower-inexp… ∗∗∗ GreyNoise launches free scanner to check if youre part of a botnet ∗∗∗ --------------------------------------------- GreyNoise Labs has launched a free tool called GreyNoise IP Check that lets users check if their IP address has been observed in malicious scanning operations, like botnet and residential proxy networks. --------------------------------------------- https://www.bleepingcomputer.com/news/security/greynoise-launches-free-scan… ∗∗∗ Seit Wochen auf Github: Virenscanner scheitern an öffentlichem Android-Trojaner ∗∗∗ --------------------------------------------- Ein neuer Android-Trojaner namens Radzarat kursiert seit Wochen auf Github. Nur die wenigsten Virenscanner sehen ihn bisher als Bedrohung. --------------------------------------------- https://www.golem.de/news/auf-github-verfuegbar-virenscanner-erkennen-oeffe… ∗∗∗ Tomiris wreaks Havoc: New tools and techniques of the APT group ∗∗∗ --------------------------------------------- Kaspersky discloses new tools and techniques discovered in 2025 Tomiris activities: multi-language reverse shells, Havoc and AdaptixC2 open-source frameworks, communications via Discord and Telegram. --------------------------------------------- https://securelist.com/tomiris-new-tools/118143/ ∗∗∗ Prompt Injection Through Poetry ∗∗∗ --------------------------------------------- In a new paper, “Adversarial Poetry as a Universal Single-Turn Jailbreak Mechanism in Large Language Models,” researchers found that turning LLM prompts into poetry resulted in jailbreaking the models. --------------------------------------------- https://www.schneier.com/blog/archives/2025/11/prompt-injection-through-poe… ∗∗∗ MS Teams Guest Access Can Remove Defender Protection When Users Join External Tenants ∗∗∗ --------------------------------------------- Cybersecurity researchers have shed light on a cross-tenant blind spot that allows attackers to bypass Microsoft Defender for Office 365 protections via the guest access feature in Teams. --------------------------------------------- https://thehackernews.com/2025/11/ms-teams-guest-access-can-remove.html ∗∗∗ The Anatomy of a Bulletproof Hoster: A Data-Driven Reconstruction of Media Land ∗∗∗ --------------------------------------------- This post uses the leaked internal database of Media Land, a sanctioned bulletproof hosting provider, to reconstruct how its platform organised customers, subscriptions, virtual machines, and IP address space across billing, compute, and network layers. --------------------------------------------- https://disclosing.observer/2025/11/24/bulletproof-hoster-anatomy-data-driv… ∗∗∗ How CVSS v4.0 works: characterizing and scoring vulnerabilities ∗∗∗ --------------------------------------------- This blog explains why vulnerability scoring matters, how CVSS works, and what’s new in version 4.0. --------------------------------------------- https://www.malwarebytes.com/blog/news/2025/11/how-cvss-v4-0-works-characte… ∗∗∗ Achtung, Falle! Gefälschte BMF-Rückerstattung-Mails im Umlauf ∗∗∗ --------------------------------------------- Wer aktuell eine E-Mail im Postfach hat, in der das Bundesministerium für Finanzen (BMF) eine Steuerrückerstattung verspricht, sollte vorsichtig sein. Denn derzeit versenden Kriminelle solche E-Mails, um Sie zur Preisgabe von Daten und zur Überweisung von Geld zu bewegen. --------------------------------------------- https://www.watchlist-internet.at/news/achtung-falle-gefaelschte-bmf-ruecke… ∗∗∗ 3 OAuth TTPs Seen This Month — and How to Detect Them with Entra ID Logs ∗∗∗ --------------------------------------------- How OAuth tokens, JWT fields and Entra sign-in logs reveal attacker behavior, and how to turn those signals into reliable detections. --------------------------------------------- https://www.wiz.io/blog/recent-oauth-attacks-detection-strategies ===================== = Vulnerabilities = ===================== ∗∗∗ Installer of INZONE Hub may insecurely load Dynamic Link Libraries ∗∗∗ --------------------------------------------- The installer of INZONE Hub provided by Sony Corporation may insecurely load Dynamic Link Libraries. --------------------------------------------- https://jvn.jp/en/jp/JVN28247549/ ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (krita and tryton-server), Oracle (bind9.18, ipa, kernel, libssh, redis, redis:7, sqlite, sssd, and vim), Slackware (cups), SUSE (containerd, cups, curl, dovecot24, git-bug, gitea-tea, glib2, grub2, himmelblau, java-25-openjdk, kernel, libmicrohttpd, libvirt, pnpm, powerpc-utils, python311, python313, redis, rnp, runc, sssd, tomcat11, unbound, and xwayland), and Ubuntu (cups, libxml2, openvpn, and webkit2gtk). --------------------------------------------- https://lwn.net/Articles/1048596/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 27.11.2025
by Daily end-of-shift report 27 Nov '25

27 Nov '25

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 26-11-2025 18:00 − Donnerstag 27-11-2025 18:00 Handler: Michael Schlagenhaufer Co-Handler: Felician Fuchs ===================== = News = ===================== ∗∗∗ Ein kurzer Blick auf das NISG 2026 ∗∗∗ --------------------------------------------- Wirklich viel hat sich zwischen dem abgelehnten Entwurf von 2024 und dem am 20. November eingebrachten Text nicht geändert. Ich will hier nur kurz zwei Punke ansprechen. Recital 44: [..] Wie schon im Sommer angemerkt, ist uns nicht klar, was der EU-Gesetzgeber uns damit sagen will. [..] Eine kurze Umfrage im CSIRTs Network hat gezeigt, dass auch die anderen Teams an dieser Frage kiefeln. --------------------------------------------- https://www.cert.at/de/blog/2025/11/ein-kurzer-blick-auf-das-nisg-2026 ∗∗∗ Shai-Hulud v2 Spreads From npm to Maven, as Campaign Exposes Thousands of Secrets ∗∗∗ --------------------------------------------- The second wave of the Shai-Hulud supply chain attack has spilled over to the Maven ecosystem after compromising more than 830 packages in the npm registry. The Socket Research Team said it identified a Maven Central package named org.mvnpm:posthog-node:4.18.1 that embeds the same two components associated with Sha1-Hulud: the "setup_bun.js" loader and the main payload "bun_environment.js. --------------------------------------------- https://thehackernews.com/2025/11/shai-hulud-v2-campaign-spreads-from-npm.h… ∗∗∗ New ShadowV2 botnet malware used AWS outage as a test opportunity ∗∗∗ --------------------------------------------- A new Mirai-based botnet malware named ShadowV2 has been observed targeting IoT devices from D-Link, TP-Link, and other vendors with exploits for known vulnerabilities. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-shadowv2-botnet-malware-… ∗∗∗ Zendesk users targeted as Scattered Lapsus$ Hunters spin up fake support sites ∗∗∗ --------------------------------------------- ReliaQuest finds fresh crop of phishing domains and toxic tickets Scattered Lapsus$ Hunters may be circling Zendesk users for its latest extortion campaign, with new phishing domains and weaponized helpdesk tickets uncovered by ReliaQuest. --------------------------------------------- https://go.theregister.com/feed/www.theregister.com/2025/11/27/scattered_la… ∗∗∗ Rituals Adventkalender zu gewinnen? Vorsicht vor der Phishing-Falle! ∗∗∗ --------------------------------------------- Die neueste virale Variante: Ein angeblich kostenloser Adventkalender von Rituals. Dahinter versteckt sich allerdings eine Kombination aus unterschiedlichen Betrugsmaschen: Abo-Falle & Diebstahl von Kreditkartendaten, garniert mit einem Kettenbrief. --------------------------------------------- https://www.watchlist-internet.at/news/rituals-adventkalender-phishing/ ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (kdeconnect, libssh, and samba), Fedora (7zip, docker-buildkit, and docker-buildx), Oracle (bind, buildah, cups, delve and golang, expat, firefox, gimp, go-rpm-macros, haproxy, kernel, lasso, libsoup, libtiff, mingw-expat, openssl, podman, python-kdcproxy, qt5-qt3d, runc, squid, thunderbird, tigervnc, valkey, webkit2gtk3, xorg-x11-server, and xorg-x11-server-Xwayland), SUSE (buildah, cloudflared, containerd, expat, firefox, gnutls, helm, kernel, libxslt, mysql-connector-java, ongres-scram, openbao, openexr, openssh, podman, python311, python312, ruby2.5, rubygem-rack, runc, samba, sssd, tiff, unbound, and yelp), and Ubuntu (edk2, ffmpeg, h2o, python3.13, rust-openssl, and valkey) --------------------------------------------- https://lwn.net/Articles/1048448/ ∗∗∗ GitLab Patch Release: 18.6.1, 18.5.3, 18.4.5 ∗∗∗ --------------------------------------------- GitLab releases fixes for vulnerabilities in patch releases. [..] We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible. --------------------------------------------- https://about.gitlab.com/releases/2025/11/26/patch-release-gitlab-18-6-1-re… ∗∗∗ Sicherheitsupdates: Angreifer können Anmeldung von Asus-Routern umgehen ∗∗∗ --------------------------------------------- Unter anderem eine kritische Sicherheitslücke gefährdet Router von Asus. Es kann Schadcode auf Geräte gelangen. [..] Welche Modelle konkret betroffen sind, geht aus dem Sicherheitsbereich der Asus-Website nicht hervor. Dort wird nur „Asus-Router-Firmware“ als verwundbar genannt. [..] Am gefährlichsten gilt eine „kritische“ Schwachstelle (CVE-2025-59366) in der AiCloud-Komponente. [..] Drei weitere Lücken (CVE-2025-59370, CVE-2025-59371, CVE-2025-12003) sind mit dem Bedrohungsgrad „hoch“ versehen. --------------------------------------------- https://heise.de/-11093767 ∗∗∗ ABB Ability Camera Connect Vulnerabilities in outdated 3rd party component (VLC) ∗∗∗ --------------------------------------------- https://search.abb.com/library/Download.aspx?DocumentID=4HZM000603&Language… ∗∗∗ Splunk: SVD-2025-1104: Third-Party Package Updates in Splunk SOAR - November 2025 ∗∗∗ --------------------------------------------- https://advisory.splunk.com//advisories/SVD-2025-1104 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 26.11.2025
by Daily end-of-shift report 26 Nov '25

26 Nov '25

===================== = End-of-Day report = ===================== Timeframe: Dienstag 25-11-2025 18:30 − Mittwoch 26-11-2025 18:00 Handler: Michael Schlagenhaufer Co-Handler: Felician Fuchs ===================== = News = ===================== ∗∗∗ Old tech, new vulnerabilities: NTLM abuse, ongoing exploitation in 2025 ∗∗∗ --------------------------------------------- This article covers NTLM relay, credential forwarding, and other NTLM-related vulnerabilities and cyberattacks discovered in 2025. --------------------------------------------- https://securelist.com/ntlm-abuse-in-2025/118132/ ∗∗∗ Chrome Extension Caught Injecting Hidden Solana Transfer Fees Into Raydium Swaps ∗∗∗ --------------------------------------------- Cybersecurity researchers have discovered a new malicious extension on the Chrome Web Store thats capable of injecting a stealthy Solana transfer into a swap transaction and transferring the funds to an attacker-controlled cryptocurrency wallet. --------------------------------------------- https://thehackernews.com/2025/11/chrome-extension-caught-injecting.html ∗∗∗ Qilin Ransomware Turns South Korean MSP Breach Into 28-Victim Korean Leaks Data Heist ∗∗∗ --------------------------------------------- South Koreas financial sector has been targeted by what has been described as a sophisticated supply chain attack that led to the deployment of Qilin ransomware. --------------------------------------------- https://thehackernews.com/2025/11/qilin-ransomware-turns-south-korean-msp.h… ∗∗∗ HashJack attack shows AI browsers can be fooled with a simple ‘#’ ∗∗∗ --------------------------------------------- Hashtag-do-whatever-I-tell-you Cato Networks says it has discovered a new attack, dubbed "HashJack," that hides malicious prompts after the "#" in legitimate URLs, tricking AI browser assistants into executing them while dodging traditional network and server-side defenses. --------------------------------------------- https://go.theregister.com/feed/www.theregister.com/2025/11/25/hashjack_att… ∗∗∗ Zscaler Threat Hunting Discovers and Reconstructs a Sophisticated Water Gamayun APT Group Attack ∗∗∗ --------------------------------------------- This blog is intended to share an in-depth analysis of a recent multi-stage attack attributed to the Water Gamayun advanced persistent threat group (APT). Drawing on telemetry, forensic reconstruction, and known threat intelligence, the Zscaler Threat Hunting team reconstructed how a seemingly innocuous web search led to a sophisticated exploitation of a Windows MMC vulnerability, ultimately delivering hidden PowerShell payloads and final malware loaders. --------------------------------------------- https://www.zscaler.com/blogs/security-research/water-gamayun-apt-attack ∗∗∗ Studie: [EXTERN]-Tags schützen nicht vor Phishing ∗∗∗ --------------------------------------------- Eine großangelegte Simulation an einer deutschen Universitätsklinik zeigt: Gängige Schutzmaßnahmen wie [EXTERN]-Tags versagen, technische Filter wirken. --------------------------------------------- https://www.heise.de/news/Studie-EXTERN-Tags-schuetzen-nicht-vor-Phishing-1… ∗∗∗ So erkennen Sie Fake-Apotheken wie grazapotheke.com ∗∗∗ --------------------------------------------- Mit Beginn der Erkältungssaison steigt die Nachfrage nach Onlineapotheken. Doch neben seriösen Anbietern tummeln sich auch gefährliche Fälschungen im Netz. Ein Beispiel ist grazapotheke.com, die rezeptpflichtige Medikamente scheinbar frei verkauft. --------------------------------------------- https://www.watchlist-internet.at/news/so-erkennen-sie-fake-apotheken-wie-g… ∗∗∗ The Golden Scale: Tis the Season for Unwanted Gifts ∗∗∗ --------------------------------------------- Unit 42 shares further updates of cybercrime group Scattered LAPSUS$ Hunters. Secure your organization this holiday season. The post The Golden Scale: Tis the Season for Unwanted Gifts appeared first on Unit 42. --------------------------------------------- https://unit42.paloaltonetworks.com/new-shinysp1d3r-ransomware/ ∗∗∗ MySQL 8.0 fällt am 30. April 2026 aus dem Support ∗∗∗ --------------------------------------------- Baut sich ein weiteres Software-Problem in der IT-Landschaft auf? Das Open Source-Datenbanksystem MySQL ist sehr populär und breit im Einsatz. Aber MySQL 8.0 fällt am 30. April 2026 aus dem Support. --------------------------------------------- https://www.borncity.com/blog/2025/11/26/mysql-8-0-faellt-am-30-april-2026-… ∗∗∗ Sharjah Police Experiment Exposes How Easily People Fall for Fake QR Codes ∗∗∗ --------------------------------------------- A cybersecurity experiment conducted by Sharjah Police has revealed how easily QR codes can mislead individuals, particularly when these codes promise conveniences such as free WiFi. The police placed an unbranded QR code in a public area with a simple message, “Free WiFi”, to measure how many people would scan it without verifying its source. The results revealed that 89 members of the public scanned the code without asking who placed it or whether it was legitimate. --------------------------------------------- https://thecyberexpress.com/free-wifi-qr-code-risk-experiment/ ===================== = Vulnerabilities = ===================== ∗∗∗ VU#521113: Forge JavaScript library impacted by a vulnerability in signature verification. ∗∗∗ --------------------------------------------- The Forge JavaScript library provides TLS-related cryptographic utilities. A vulnerability that allows signature verification to be bypassed through crafted manipulation of ASN.1 structures, particularly in fields such as Message Authentication Code (MAC) data, was identified. --------------------------------------------- https://kb.cert.org/vuls/id/521113 ∗∗∗ ZDI-25-1019: Arista NG Firewall replace_marker Exposed Dangerous Function Authentication Bypass Vulnerability ∗∗∗ --------------------------------------------- This vulnerability allows remote attackers to to bypass authentication on affected installations of Arista NG Firewall. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2025-6979. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-25-1019/ ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (bind, binutils, delve and golang, expat, firefox, haproxy, kernel, libsoup3, libssh, libtiff, openssh, openssl, pam, podman, python-kdcproxy, shadow-utils, squid, thunderbird, vim, xorg-x11-server-Xwayland, and zziplib), Debian (cups-filters, libsdl2, linux-6.1, net-snmp, pdfminer, rails, and tryton-sao), Fedora (chromium, docker-buildkit, docker-buildx, and sudo-rs), Gentoo (librnp), Mageia (webkit2), SUSE (amazon-ssm-agent, buildah, curl, dpdk, fontforge-20251009, kernel, libIex-3_4-33, librnp0, python311, rclone, and sssd), and Ubuntu (linux, linux-aws, linux-aws-6.8, linux-ibm, linux-lowlatency, linux-lowlatency-hwe-6.8, linux-nvidia, linux-nvidia-6.8, linux-nvidia-lowlatency, linux-oracle, linux-aws-6.14, linux-oracle-6.14, linux-aws-fips, linux-fips, linux-gcp-fips, linux-realtime, linux-realtime-6.8, mupdf, openjdk-17, openjdk-8, and openjdk-lts). --------------------------------------------- https://lwn.net/Articles/1048195/ ∗∗∗ CISA Releases Seven Industrial Control Systems Advisories ∗∗∗ --------------------------------------------- CISA released seven Industrial Control Systems (ICS) Advisories: ICSA-25-329-01 Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, Cobalt, Share. ICSA-25-329-02 Rockwell Automation Arena Simulation. ICSA-25-329-03 Zenitel TCIV-3+. ICSA-25-329-04 Opto 22 groov View. ICSA-25-329-05 Festo Compact Vision System, Control Block, Controller, and Operator Unit products. ICSA-25-329-06 SiRcom SMART. --------------------------------------------- https://www.cisa.gov/news-events/alerts/2025/11/25/cisa-releases-seven-indu… ∗∗∗ Nvidia DGX Spark, NeMo: Kritische Lücken gefährden KI-Hard- und Software ∗∗∗ --------------------------------------------- Nvidias KI-Hard- und Software DGX Spark und NeMo Framework sind verwundbar. Sicherheitsupdates schließen mehrere Schwachstellen. Im schlimmsten Fall können Angreifer Systeme nach der Ausführung von Schadcode in Gänze kompromittieren. Bislang gibt es keine Berichte zu laufenden Attacken. --------------------------------------------- https://heise.de/-11092387 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 25.11.2025
by Daily end-of-shift report 25 Nov '25

25 Nov '25

===================== = End-of-Day report = ===================== Timeframe: Montag 24-11-2025 19:30 − Dienstag 25-11-2025 18:30 Handler: Felician Fuchs Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Malicious Blender model files deliver StealC infostealing malware ∗∗∗ --------------------------------------------- A Russian-linked campaign delivers the StealC V2 information stealer malware through malicious Blender files uploaded to 3D model marketplaces like CGTrader. --------------------------------------------- https://www.bleepingcomputer.com/news/security/malicious-blender-model-file… ∗∗∗ Tor switches to new Counter Galois Onion relay encryption algorithm ∗∗∗ --------------------------------------------- Tor has announced improved encryption and security for the circuit traffic by replacing the old tor1 relay encryption algorithm with a new design called Counter Galois Onion (CGO). --------------------------------------------- https://www.bleepingcomputer.com/news/security/tor-switches-to-new-counter-… ∗∗∗ JackFix Uses Fake Windows Update Pop-Ups on Adult Sites to Deliver Multiple Stealers ∗∗∗ --------------------------------------------- Cybersecurity researchers are calling attention to a new campaign thats leveraging a combination of ClickFix lures and fake adult websites to deceive users into running malicious commands under the guise of a "critical" Windows security update. --------------------------------------------- https://thehackernews.com/2025/11/jackfix-uses-fake-windows-update-pop.html ∗∗∗ Years of JSONFormatter and CodeBeautify Leaks Expose Thousands of Passwords and API Keys ∗∗∗ --------------------------------------------- New research has found that organizations in various sensitive sectors, including governments, telecoms, and critical infrastructure, are pasting passwords and credentials into online tools like JSONformatter and CodeBeautify that are used to format and validate code. --------------------------------------------- https://thehackernews.com/2025/11/years-of-jsonformatter-and-codebeautify.h… ∗∗∗ Ex-CISA officials, CISOs dispel hacklore, spread cybersecurity truths ∗∗∗ --------------------------------------------- Dont believe everything you read Afraid of connecting to public Wi-Fi? Terrified to turn your Bluetooth on? You may be falling for "hacklore," tall tales about cybersecurity that distract you from real dangers. Dozens of chief security officers and ex-CISA officials have launched an effort and website to dispel these myths and show you how not to get hacked for real. --------------------------------------------- www.theregister.com/2025/11/24/hacklore_launch/ ∗∗∗ Is Your Android TV Streaming Box Part of a Botnet? ∗∗∗ --------------------------------------------- On the surface, the Superbox media streaming devices for sale at retailers like BestBuy and Walmart may seem like a steal: They offer unlimited access to more than 2,200 pay-per-view and streaming services like Netflix, ESPN and Hulu, all for a one-time fee of around $400. But security experts warn these TV boxes require intrusive software that forces the user’s network to relay Internet traffic for others, traffic that is often tied to cybercrime activity such as advertising fraud and account takeovers. --------------------------------------------- https://krebsonsecurity.com/2025/11/is-your-android-tv-streaming-box-part-o… ∗∗∗ New ClickFix wave infects users with hidden malware in images and fake Windows updates ∗∗∗ --------------------------------------------- ClickFix just got more convincing, hiding malware in PNG images and faking Windows updates to make users run dangerous commands. --------------------------------------------- https://www.malwarebytes.com/blog/news/2025/11/new-clickfix-wave-infects-us… ∗∗∗ UEFI SecureBoot DB Update: Microsoft 2023er CAs installieren ∗∗∗ --------------------------------------------- Die SecureBoot-Zertifikate (KEK und DB) von Microsoft stammen aus dem Jahr 2011 und laufen im Jahr 2026 ab. --------------------------------------------- https://hitco.at/blog/uefi-secureboot-db-update-installieren/ ∗∗∗ Meldungen häufen sich: Kopierte Kleinanzeigen füllen Fake-Shops ∗∗∗ --------------------------------------------- Kriminelle stopfen ihre Fake-Shops immer öfter mit Bildmaterial und Produktinfos von Kleinanzeigen-Portalen voll. Komplette Annoncen landen, leicht verändert und mit einem ordentlichen Rabatt, in den betrügerischen Stores. --------------------------------------------- https://www.watchlist-internet.at/news/kopierte-kleinanzeigen-fuellen-fake-… ∗∗∗ Russia arrests young cybersecurity entrepreneur on treason charges ∗∗∗ --------------------------------------------- Details of the case are classified, but Russian media say Timur Kilin may have drawn official ire after publicly criticizing the state-owned messaging app Max and the government’s anti-cybercrime legislation. --------------------------------------------- https://therecord.media/russia-arrests-tech-entrepreneur-treason ∗∗∗ Update Firefox to Patch CVE-2025-13016 Vulnerability Affecting 180 Million Users ∗∗∗ --------------------------------------------- AI security firm AISLE revealed CVE-2025-13016, a critical Firefox Wasm bug that risked 180M users for six months. Learn how the memory flaw allowed code execution. --------------------------------------------- https://hackread.com/update-firefox-patch-cve-2025-13016-vulnerability/ ∗∗∗ Spyware Allows Cyber Threat Actors to Target Users of Messaging Applications ∗∗∗ --------------------------------------------- CISA is aware of multiple cyber threat actors actively leveraging commercial spyware to target users of mobile messaging applications (apps). These cyber actors use sophisticated targeting and social engineering techniques to deliver spyware and gain unauthorized access to a victim’s messaging app, facilitating the deployment of additional malicious payloads that can further compromise the victim’s mobile device. --------------------------------------------- https://www.cisa.gov/news-events/alerts/2025/11/24/spyware-allows-cyber-thr… ∗∗∗ The Hidden Dangers of Calendar Subscriptions: 4 Million Devices at Risk ∗∗∗ --------------------------------------------- Bitsight TRACE discovered more than 390 abandoned domains related to iCalendar synchronization (sync) requests for subscribed calendars, potentially putting ~4 million devices at risk. --------------------------------------------- https://www.bitsight.com/blog/hidden-dangers-calendar-subscriptions-4-milli… ∗∗∗ Stop Putting Your Passwords Into Random Websites (Yes, Seriously, You Are The Problem) ∗∗∗ --------------------------------------------- Welcome to watchTowr vs the Internet, part 68.That feeling you’re experiencing? Dread. You should be used to it by now. As is fast becoming an unofficial and, apparently, frowned upon tradition - we identified incredible amounts of publicly exposed passwords, secrets, keys and more for very sensitive environments - and then spent a number of months working out if we could travel back in time to a period in which we just hadn't. --------------------------------------------- https://labs.watchtowr.com/stop-putting-your-passwords-into-random-websites… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (buildah, firefox, go-rpm-macros, kernel, kernel-rt, podman, and thunderbird), Debian (erlang, python-gevent, and r-cran-gh), Fedora (buildah, chromium, k9s, kubernetes1.33, kubernetes1.34, podman, python-mkdocs-include-markdown-plugin, and webkitgtk), Gentoo (Chromium, Google Chrome, Microsoft Edge. Opera, qtsvg, redict, redis, UDisks, and WebKitGTK+), Mageia (cups-filters and ruby-rack), Oracle (kernel and libssh), Red Hat (.NET 8.0, tigervnc, xorg-x11-server, and xorg-x11-server-Xwayland), SUSE (act, bind, cups-filters, govulncheck-vulndb, grub2, libebml, python39, and tcpreplay), and Ubuntu (linux-raspi, linux-raspi-realtime, openjdk-21, openjdk-25, python3.12, python3.11, python3.10, python3.9, python3.8, python3.7, python3.6, python3.5, python3.4, and runc-app, runc-stable). --------------------------------------------- https://lwn.net/Articles/1047950/ ∗∗∗ Synology-SA-25:15 ActiveProtect Agent ∗∗∗ --------------------------------------------- Synology has released a security update for the ActiveProtect Agent on Windows to address a vulnerability: CVE-2025-13593 allows local users to write arbitrary files with restricted content.Please refer to the Affected Products table for the corresponding updates. --------------------------------------------- https://www.synology.com/en-global/support/security/Synology_SA_25_15 ∗∗∗ Azure Bastion mit schwerer Schwachstelle CVE-2025-49752 ∗∗∗ --------------------------------------------- Der Microsoft Azure Bastion-Dienst zum sicheren und nahtlosen RDP- und SSH-Zugriff auf virtuelle Azure-Maschinen (VMs) weist für alle Bereitstellungen vor dem 20. November 2025 eine schwere Schwachstelle CVE-2025-49752 (CVSS Score 10.0) auf. --------------------------------------------- https://www.borncity.com/blog/2025/11/25/azure-bastion-mit-schwerer-schwach… ∗∗∗ Asus stopft hochriskante Rechteausweitungslücke in MyAsus ∗∗∗ --------------------------------------------- Asus warnt vor einer als hochriskant eingestuften Sicherheitslücke in der MyAsus-Software. Ein Update steht bereit. --------------------------------------------- https://heise.de/-11090371 ∗∗∗ Security Advisory for SiRcom SMART Alert (SiSA) ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-25-329-06 ∗∗∗ Security Advisory for Festo Compact Vision System, Control Block, Controller, and Operator Unit products ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-25-329-05 ∗∗∗ Security Advisory for Zenitel TCIV-3+ ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-25-329-03 ∗∗∗ Security Advisory for Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, Cobalt Share ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-25-329-01 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 24.11.2025
by Daily end-of-shift report 24 Nov '25

24 Nov '25

===================== = End-of-Day report = ===================== Timeframe: Freitag 21-11-2025 18:00 − Montag 24-11-2025 19:30 Handler: Felician Fuchs Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Shai-Hulud 2.0: Ongoing Supply Chain Attack ∗∗∗ --------------------------------------------- Detect and mitigate malicious npm packages linked to the recent Shai-Hulud-style campaign. Over 25,000 affected repositories across ~350 unique users. --------------------------------------------- https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack ∗∗∗ How to know if your Asus router is one of thousands hacked by China-state hackers ∗∗∗ --------------------------------------------- So far, the hackers are laying low, likely for later use. --------------------------------------------- https://arstechnica.com/security/2025/11/thousands-of-hacked-asus-routers-a… ∗∗∗ CrowdStrike catches insider feeding information to hackers ∗∗∗ --------------------------------------------- American cybersecurity firm CrowdStrike has confirmed that an insider shared screenshots taken on internal systems with hackers after they were leaked on Telegram by the Scattered Lapsus$ Hunters threat actors. --------------------------------------------- https://www.bleepingcomputer.com/news/security/crowdstrike-catches-insider-… ∗∗∗ Ausgesperrt aus dem eigenen Körper: Zauberkünstler vergisst Passwort für Hand-Chip ∗∗∗ --------------------------------------------- Ein Magier hat sich durch ein vergessenes Passwort dauerhaft aus dem RFID-Chip in seiner eigenen Hand ausgesperrt. --------------------------------------------- https://www.golem.de/news/ausgesperrt-aus-dem-eigenen-koerper-zauberkuenstl… ∗∗∗ ShadowPad Malware Actively Exploits WSUS Vulnerability for Full System Access ∗∗∗ --------------------------------------------- A recently patched security flaw in Microsoft Windows Server Update Services (WSUS) has been exploited by threat actors to distribute malware known as ShadowPad. --------------------------------------------- https://thehackernews.com/2025/11/shadowpad-malware-actively-exploits.html ∗∗∗ ShinyHunters does not like Salesforce at all, claims the crew accessed Gainsight 3 months ago ∗∗∗ --------------------------------------------- Shiny talks to The Reg EXCLUSIVE ShinyHunters has claimed responsibility for the Gainsight breach that allowed the data thieves to snarf data from hundreds more Salesforce customers. --------------------------------------------- www.theregister.com/2025/11/21/shinyhunters_salesforce_gainsight_breach/ ∗∗∗ Amazon Is Using Specialized AI Agents for Deep Bug Hunting ∗∗∗ --------------------------------------------- Born out of an internal hackathon, Amazon’s Autonomous Threat Analysis system uses a variety of specialized AI agents to detect weaknesses and propose fixes to the company’s platforms. --------------------------------------------- https://www.wired.com/story/amazon-autonomous-threat-analysis/ ∗∗∗ DHL-Phishing zur Online-Handel-Blütezeit ∗∗∗ --------------------------------------------- Mit der "Cyber-Week" startet der Online-Handel in den Jahresendspurt. Online-Betrüger wollen Opfer mit angeblichen Nachzahlungen ködern. --------------------------------------------- https://www.heise.de/news/DHL-Phishing-zur-Online-Handel-Bluetezeit-1108844… ∗∗∗ Fahrradhersteller Woom: IT-Einbruch durch Cybergang INC Ransom ∗∗∗ --------------------------------------------- Vor zwei Wochen gab es einen IT-Einbruch beim Kinderradhersteller Woom. Die Cybergang INC Ransom droht mit Datenveröffentlichung. --------------------------------------------- https://www.heise.de/news/Fahrradhersteller-Woom-IT-Einbruch-durch-Cybergan… ∗∗∗ IT-Sicherheit: BSI will Webmail-Anbieter stärker in die Pflicht nehmen ∗∗∗ --------------------------------------------- Die E-Mail-Sicherheit lastet größtenteils auf den Schultern der Anwender, moniert das BSI. Es sieht die Betreiber etwa bei der Anmeldung in der Verantwortung. --------------------------------------------- https://www.heise.de/news/IT-Sicherheit-BSI-will-Webmail-Anbieter-staerker-… ∗∗∗ Matrix Push C2 abuses browser notifications to deliver phishing and malware ∗∗∗ --------------------------------------------- Attackers can send highly realistic push notifications through your browser, including fake alerts that can lead to malware or phishing pages. --------------------------------------------- https://www.malwarebytes.com/blog/news/2025/11/matrix-push-c2-abuses-browse… ∗∗∗ Vorsicht vor gefälschten Rückerstattungen der ÖGK! ∗∗∗ --------------------------------------------- Derzeit verbreitet sich erneut eine Phishing-Welle, die viele Österreicher:innen betrifft. In betrügerischen E-Mails wird behauptet, man habe Anspruch auf eine Rückerstattung der Österreichischen Gesundheitskasse (ÖGK). Wer der Aufforderung folgt, führt jedoch eine Überweisung an Kriminelle durch. --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-vor-gefaelschten-rueckersta… ∗∗∗ Kundendaten von US-Banken nach Cyberattacke womöglich kompromittiert ∗∗∗ --------------------------------------------- Ein Cyberangriff auf den Dienstleister SitusAMC könnte Kundendaten großer US-Banken wie JPMorgan Chase, Citi und Morgan Stanley kompromittiert haben. --------------------------------------------- https://www.derstandard.at/story/3000000297610/kundendaten-von-us-banken-na… ∗∗∗ SmbCrawler – SMB Share Discovery and Secret-Hunting ∗∗∗ --------------------------------------------- SmbCrawler is a credentialed SMB share crawler for red teams that discovers misconfigured shares and hunts secrets across Windows networks. --------------------------------------------- https://www.darknet.org.uk/2025/11/smbcrawler-smb-share-discovery-and-secre… ∗∗∗ GhostAd: Hidden Google Play Adware Drains Devices and Disrupts Millions of Users ∗∗∗ --------------------------------------------- Check Point researchers uncover a large-scale Android adware campaign that silently drains resources and disrupts normal phone use through persistent background activity. During an internal threat-hunting investigation, Check Point Harmony Mobile Detection Team identified a network of Android applications on Google Play masquerading as harmless utility and emoji-editing tools. --------------------------------------------- https://blog.checkpoint.com/research/ghostad-hidden-google-play-adware-drai… ∗∗∗ SesameOp: Neuartige Backdoor in OpenAI API für C&C missbraucht ∗∗∗ --------------------------------------------- Sicherheitsforscher von Microsoft sind auf eine neuartige Backdoor in der OpenAI Assistant API gestoßen, und haben diese SesameOp genannt. Diese neuartige Backdoor, die von einem Angreifer verwendet wurde, nutzt die API des OpenAI Assistant, um Befehls- und Kontrollfunktionen für Cyberangriffe zu implementieren. --------------------------------------------- https://www.borncity.com/blog/2025/11/22/sesameop-neuartige-backdoor-in-ope… ∗∗∗ Smartmeter: Daten wecken Begehrlichkeiten (der Polizei in Sacramento) ∗∗∗ --------------------------------------------- Smartmeter erfassen ja den Stromverbrauch in Haushalten, und es gibt große Bedenken, dass diese neue Technologie missbraucht werden könnte. In den USA hat die Stadt Sacramento einen entsprechenden Skandal, bei dem der Betreiber der intelligenten Stromzähler ohne richterlichen Beschluss an die örtliche Polizei weitergegeben hat. Die Praxis wurde jetzt von einem Richter gestoppt. --------------------------------------------- https://www.borncity.com/blog/2025/11/23/smartmeter-daten-wecken-begehrlich… ∗∗∗ WTF: Schlüssel weg – Kryptologen kommen nicht an ihre Wahlergebnisse ∗∗∗ --------------------------------------------- Eine renommierte Gruppe von Kryptologie-Forschern nutzt ein ausgefeiltes Schutzsystem – und fällt ihm schließlich selbst zum Opfer. --------------------------------------------- https://heise.de/-11088550 ∗∗∗ A Reverse Engineer’s Anatomy of the macOS Boot Chain & Security Architecture ∗∗∗ --------------------------------------------- The security of the macOS platform on Apple Silicon is not defined by the kernel; it is defined by the physics of the die. Before the first instruction of kernelcache is fetched, a complex, cryptographic ballet has already concluded within the Application Processor (AP). This section dissects the immutable hardware logic that establishes the initial link in the Chain of Trust. --------------------------------------------- http://stack.int.mov/a-reverse-engineers-anatomy-of-the-macos-boot-chain-se… ===================== = Vulnerabilities = ===================== ∗∗∗ Grafana warns of max severity admin spoofing vulnerability ∗∗∗ --------------------------------------------- Grafana Labs is warning of a maximum severity vulnerability (CVE-2025-41115) in its Enterprise product that can be exploited to treat new users as administrators or for privilege escalation. --------------------------------------------- https://www.bleepingcomputer.com/news/security/grafana-warns-of-max-severit… ∗∗∗ CISA warns Oracle Identity Manager RCE flaw is being actively exploited ∗∗∗ --------------------------------------------- The U.S. Cybersecurity & Infrastructure Security Agency (CISA) is warning government agencies to patch an Oracle Identity Manager tracked as CVE-2025-61757 that has been exploited in attacks, potentially as a zero-day. --------------------------------------------- https://www.bleepingcomputer.com/news/security/cisa-warns-oracle-identity-m… ∗∗∗ Malware im Anmarsch: Kritische Windows-Lücke ermöglicht Angriffe über JPEG-Daten ∗∗∗ --------------------------------------------- Forscher warnen vor einer kritischen Sicherheitslücke in einer Windows-Bibliothek. Angreifer können über JPEG-Bilddaten Schadcode einschleusen. --------------------------------------------- https://www.golem.de/news/malware-im-anmarsch-kritische-windows-luecke-ermo… ∗∗∗ Jetzt patchen! Schadcode-Attacken auf Oracle Identity Manager beobachtet ∗∗∗ --------------------------------------------- Es gibt Hinweise, dass Angreifer Oracle Identity Manager bereits seit August dieses Jahres attackieren. Ein Sicherheitsupdate ist vorhanden. --------------------------------------------- https://www.heise.de/news/Jetzt-patchen-Schadcode-Attacken-auf-Oracle-Ident… ∗∗∗ HCL BigFix: Sicherheitsprobleme bei SAML-Authentifizierung ∗∗∗ --------------------------------------------- Die Endpoint-Management-Plattform BigFix von HCL ist verwundbar. Nun haben die Entwickler eine kritische Sicherheitslücke geschlossen. --------------------------------------------- https://www.heise.de/news/HCL-BigFix-Sicherheitsprobleme-bei-SAML-Authentif… ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Fedora (calibre, chromium, cri-o1.32, cri-o1.33, cri-o1.34, dotnet10.0, dovecot, gnutls, gopass, gopass-hibp, gopass-jsonapi, kubernetes1.31, kubernetes1.32, kubernetes1.33, kubernetes1.34, and linux-firmware), Mageia (ffmpeg, kernel, kmod-xtables-addons & kmod-virtualbox, kernel-linus, konsole, and redis), Red Hat (bind and bind-dyndb-ldap and kernel), SUSE (act, alloy, amazon-ssm-agent, ansible-12, ansible-core, blender, chromium, cups-filters, curl, elfutils, expat, firefox, glib2, grub2, helm, kernel, libipa_hbac-devel, libxslt, nvidia-container-toolkit, ongres-scram, openexr, podman, poppler, runc, samba, sssd, thunderbird, and tomcat), and Ubuntu (cups-filters, linux, linux-aws, linux-gcp, linux-hwe-6.14, linux-oracle, linux-realtime, linux-oem-6.14, and linux-realtime-6.14). --------------------------------------------- https://lwn.net/Articles/1047682/ ∗∗∗ Synology-SA-25:14 DSM (PWN2OWN 2025) ∗∗∗ --------------------------------------------- Synology has released a security update for the DSM to address ZDI-CAN-28409: CVE-2025-13392 allows remote attackers to bypass authentication with prior knowledge of the distinguished name (DN).Please refer to the Affected Products table for the corresponding updates. --------------------------------------------- https://www.synology.com/en-global/support/security/Synology_SA_25_14 ∗∗∗ VU#761751: fluentbit contains stack buffer overflow, authentication bypass, and path traversal flaws ∗∗∗ --------------------------------------------- https://kb.cert.org/vuls/id/761751 ∗∗∗ F5: K000157948, BIND vulnerability CVE-2025-40780 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000157948 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily