Search: “kev”

13 items

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Exploit / PoC 688 Vulnerability 354 Ransomware 99 Advisory 26 Malware 24 Data breach 22 Threat actor 13 Policy & legal 10 Industry 8 AI safety & security 3 Tools 3 AI tools & infra 1 Phishing & fraud 1 Research 1

SeverityAll critical 950 high 268 medium 18 low 0 info 17

TrueConf Server Flaws Exploited to Replace Client Installers with PhantomCore

Head Mare exploits TrueConf server flaws to install web shells and deliver PhantomCore and PhantomGraph backdoors at Russian organizations.

Kaspersky detected July 2026 attacks by the threat actor Head Mare exploiting a vulnerability chain (KLCERT-26-057 and KLCERT-26-058) in unpatched TrueConf videoconferencing servers. The chain enables arbitrary code execution with SYSTEM privileges, deployment of a web shell at locale.php, and replacement of client installers with versions delivering the PhantomCore backdoor and PhantomGraph, which uses Microsoft OneDrive as C2. Targets span Russian instrumentation, electronics, transport, energy, IT, and software firms. Patches shipped in TrueConf Server 5.3.9, 5.4.9, and 5.5.5 on June 18, 2026.

The Hacker NewsAug 21, 09:43 UTC · 27d agoThreat actor in the wild1

Risky Bulletin: Slovakia finds Russian backdoor in traffic speed cameras

Slovakia's NBU found an SMS-triggered backdoor in Russian-made NERO R-ONE traffic cameras, pausing a 279-unit deployment.

Slovakia's national security service NBU issued an alert against NERO R-ONE high-speed traffic cameras after finding a backdoor that grants shell and network access via SMS from hardcoded Russian phone numbers. The cameras are a rebranded version of the Russian CORDON PRO.M model by St. Petersburg firm Semicon, purchased via a Cyprus shell company under a €30 million EU-funded project. The report also found SecureBoot disabled, vulnerable web management, and unauthenticated live streams; the Interior Ministry paused deployment of 279 cameras pending independent assessment.

Risky Business NewsAug 19, 04:52 UTC · 29d agoThreat actor in the wild1

Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks, Auth Bypasses, and P2P

Hunt.io disclosed Operation CameraSwarm, compromising 14,500+ Dahua cameras via credential attacks, auth bypass CVEs, and P2P relay techniques across Ukraine and Russia.

Hunt.io reconstructed a campaign codenamed Operation CameraSwarm that compromised over 14,530 Dahua devices between June 17 and July 22, 2026. Attack paths included credential attacks against 12,324 IPs, exploitation of CVE-2021-33044 and CVE-2021-33045 affecting 1,923 cameras, and P2P relay access to 283 devices behind NAT. The operator, assessed as Russian-speaking, left behind 2,616 files including tooling and campaign logs, with confirmed compromises concentrated in Ukraine and Russia. Dahua advises factory resets and firmware updates; both 2021 CVEs remain in CISA's KEV catalog.

The Hacker NewsAug 25, 15:59 UTC · 22d agoThreat actor in the wildCVE-2021-33044 CVE-2021-33045 CVE-2024-39943+1 CVEs1

Search: “kev”

TrueConf Server Flaws Exploited to Replace Client Installers with PhantomCore

Risky Bulletin: Slovakia finds Russian backdoor in traffic speed cameras

Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks, Auth Bypasses, and P2P

How nation-state cyber attacks disrupt public services and undermine citizen trust

Russia-Linked APT28 Exploited MDaemon Zero

Nation-State Attackers Exploiting Ivanti CSA Flaws for Network Infiltration

Chinese Volt Typhoon Exploits Versa Director Flaw, Targets U.S. and Global IT Sectors

Multiple threat actors exploit PHP flaw CVE-2024

State-Sponsored Hackers Exploit Two Cisco Zero

Threat actors actively exploit F5 BIG-IP flaws CVE-2023

Multiple nation-state hackers infiltrate single aviation organization

Iran-linked threat actors compromise US Federal Network

State-Sponsored Hackers Likely Exploited MS Exchange 0