Search: “Zero Day Initiative”

11 items in the last 24h

An unverified underground listing offers a claimed FortiGate SSL VPN RCE exploit for FortiOS 7.2.x/7.4.x amid ongoing exploitation of known Fortinet flaws.

Dark Web Intelligence shared an advertisement for a private '1-day' remote code execution exploit targeting FortiGate SSL VPN appliances on FortiOS 7.2.x and 7.4.x, with a claimed proof-of-concept video but no CVE, firmware builds, or technical details. The listing coincides with confirmed in-the-wild exploitation of CVE-2025-25249, an unauthenticated heap-based buffer overflow patched in January 2026 but exploited since July 2026, and CVE-2024-21762, a critical out-of-bounds write in the FortiOS and FortiProxy SSL VPN component. Fortinet has advised disabling SSL VPN where immediate upgrades are not possible.

Cyber Security Newsupdated 12:17 UTC · 1h agofirst 09:33 UTC · 4h agoExploit / PoC in the wild 8 sources CVE-2025-25249 CVE-2024-21762

Handala Hack Uses CRUDEEXCLUDE to Disable Defender Protections and Deploy HEAVYGRAMnew

Group-IB links new HEAVYGRAM and CRUDEEXCLUDE malware to Iran-aligned Handala Hack (MOIS/Void Manticore), which spies on Iranian dissidents using Defender exclusions and Telegram C2.

Group-IB documented previously unreported HEAVYGRAM and CRUDEEXCLUDE malware linked with moderate confidence to the Iran-aligned Handala Hack, assessed as a MOIS-linked persona tied to Void Manticore (Storm-0842, Banished Kitten, Red Sandstorm). CRUDEEXCLUDE uses PowerShell to add attacker-controlled Microsoft Defender exclusions, then a Delphi-based loader deploys a PyInstaller-packaged HEAVYGRAM implant that abuses Telegram bot APIs for command-and-control, shell execution, screenshots, audio recording, and Telegram Desktop data theft. The campaign targets Iranian dissidents, journalists, and academics with fake KeePass, Telegram, WhatsApp, and Pictory installers. The DOJ seized four related domains in March 2026 and the FBI published a HEAVYGRAM FLASH report on September 15.

GBHackers13:46 UTC · 12m agoThreat actor in the wild 9 sources

Unauthenticated attackers are bypassing Cisco ISE’s management interface (CVE-2026-76460)

Cisco confirmed CVE-2026-76460, an actively exploited unauthenticated authentication bypass in Cisco ISE APIs, urging immediate patching with no workarounds available.

Cisco confirmed active exploitation of CVE-2026-76460, caused by insufficient authentication control on an ISE API endpoint. A remote, unauthenticated attacker can send a crafted request to bypass the web-based management interface and gain unauthorized access to affected devices. The flaw affects Cisco ISE and ISE-PIC releases 3.0 through 3.5; fixes are 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4, with no workarounds. Cisco provided IoCs, advises checking access.log for suspicious usernames, cross-checking firewall and network logs, and re-imaging suspect nodes since attackers may delete ISE logs.

Help Net Securityupdated 13:46 UTC · 12m agofirst 10:24 UTC · 3h agoExploit / PoC in the wild 22 sources CVE-2026-76460

Authorities seize popular, long-running DDoS-for-hire service domainsnew

FBI and RCMP seized NightmareStresser DDoS-for-hire domains under Operation PowerOFF; the service enabled hundreds of thousands of attacks since at least 2022.

The Justice Department announced the court-ordered seizure of NightmareStresser's primary domain and related sites, executed by the FBI Anchorage field office and the Royal Canadian Mounted Police under Operation PowerOFF. The DDoS-for-hire service enabled hundreds of thousands of attacks or attempted attacks since at least 2022, targeting educational institutions, government agencies, gaming platforms, and millions of people. Authorities have seized more than 100 booter domains since 2018; operators remain unidentified and the service claimed to operate under Russian law.

CyberScoop13:37 UTC · 21m agoPolicy & legal 5 sources

Adversary simulation: what you need to know

UK NCSC publishes guidance on adversary simulation, comparing full spectrum and assumed breach approaches across prerequisites, testing, and reporting phases.

NCSC guidance describes two adversary simulation approaches: full spectrum, starting outside the network with an end-to-end attack, and assumed breach, starting from an internal foothold. The preferred methodology spans three phases - prerequisites (scoping, passive reconnaissance, preparation), testing (active reconnaissance, initial access, internal phase, cleanup), and reporting. The document distinguishes adversary simulation from penetration testing and stresses customer-defined objectives and minimal information sharing.

NCSC UKupdated 09:09 UTC · 4h agofirst 08:29 UTC · 5h agoAdvisory 2 sources

FamousSparrow Deploys New SparroWocky Backdoor Against Latin American Governments

China-aligned APT FamousSparrow deployed a new modular backdoor, SparroWocky, against government entities across eight Latin American countries since August 2025, ESET reports.

ESET reports that China-aligned threat actor FamousSparrow replaced its SparrowDoor implant with SparroWocky, a distinct modular C++ backdoor active against governments in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela. Around 90% of the group's targets from mid-2025 into 2026 were in Latin America, which ESET links to regional competition over US influence. The backdoor arrives via a three-component DLL side-loading chain, persists through a Windows service (ProcAuditManager) or Run keys (SnapCart), captures screenshots, and exfiltrates RC4-encrypted data over TLS C2 on ports 443 and 8080. It supports in-memory Beacon Object File execution, API hashing, and SilentMoonwalk-style call-stack spoofing; IOCs for three C2 servers were released.

GBHackersupdated 11:20 UTC · 2h agofirst 11:04 UTC · 2h agoThreat actor in the wild 4 sources CVE-2021-26855

NightEagle Hackers Target Russian Companies Using GhostContainer Backdoor

Kaspersky links NightEagle (APT-Q-95) intrusions in Russia to stolen VPN credentials, the GhostContainer Exchange backdoor, BlueKeep exploitation, and covert tunneling for espionage.

Kaspersky's Global Emergency Response Team attributes new intrusions against Russian companies to NightEagle (APT-Q-95), active since at least 2023 and previously focused on Asian organizations. The group uses valid VPN credentials, deploys the .NET-based GhostContainer backdoor on Microsoft Exchange servers, and tunnels RDP via Microsoft Dev Tunnels and rdp2tcp. In one incident operators exploited BlueKeep (CVE-2019-0708) to create an administrator account, and they performed DCSync replication against Active Directory to harvest domain password hashes. GhostContainer reuses code from Neo-reGeorg, ExchangeCmdPy.py (CVE-2020-0688), and ysoserial, and tampers with AMSI and Windows event logging to evade detection.

GBHackersupdated 07:55 UTC · 6h agofirst 05:41 UTC · 8h agoThreat actor in the wild 5 sources CVE-2019-0708 CVE-2020-06881

NightEagle Hackers Abuse Microsoft Dev Tunnels and GhostContainer to Breach Russian Companies

Kaspersky links NightEagle (APT-Q-95) intrusions in Russia to stolen VPN credentials, the GhostContainer Exchange backdoor, and Microsoft Dev Tunnels abuse.

Kaspersky's Global Emergency Response Team attributes new intrusions against Russian organizations to NightEagle (APT-Q-95), active since at least 2023 and previously focused on Asia. Initial access uses valid VPN credentials, followed by the .NET GhostContainer backdoor on Microsoft Exchange servers, which abuses ASP.NET view state injection, disables AMSI and event logging, and proxies traffic. Operators moved laterally via RDP, abused Microsoft Dev Tunnels with rdp2tcp, used Impacket atexec and netsh portproxy, and in one case exploited BlueKeep (CVE-2019-0708) to create admin accounts and attempt DCSync.

GBHackersupdated 07:55 UTC · 6h agofirst 05:41 UTC · 8h agoThreat actor in the wild 5 sources CVE-2019-0708 CVE-2020-0688

SilkParasite Hackers Use SpiceRAT Infrastructure to Target Central Asian Governments and Energy Firmsnew

Hunt.io links SpiceRAT C2 infrastructure to the China-nexus SilkParasite espionage cluster targeting Central Asian governments, telecoms, and energy firms.

Hunt.io analysis expanded the SpiceRAT command-and-control footprint tied to SilkParasite, a China-nexus espionage cluster (medium confidence per Bitdefender) targeting government, telecommunications, and energy entities across Central Asia. Five active servers coordinated from mid-March 2026 were clustered via reused hostnames, TLS certificates, and a byte-identical clone of RTX Corporation's webpage found on 13 IPs; a certificate for azure.uzrailwaystax[.]com appeared across eight servers. Domains impersonated Türkmengaz, Tojiktelecom, Turkmenistan's Foreign Ministry, and Uzbek and Kyrgyz bodies, with passive DNS history dating to mid-2022. Impersonated organizations were not confirmed as compromised; Cisco Talos previously linked SpiceRAT to SneakyChef's LNK/HTA infection chains.

GBHackers13:12 UTC · 46m agoThreat actor in the wild 2 sources

CISO's Expert Guide to Agentic Pentesting for Websitesnew

A new free guide urges CISOs to adopt autonomous AI agents for continuous website pentesting as attackers weaponize vulnerabilities in about five days.

A free guide argues annual pentesting is obsolete, citing Verizon's 2026 DBIR finding that vulnerability exploitation starts 31% of breaches and Mandiant telemetry showing a roughly five-day average time-to-exploit versus a 43-day median patch time. It highlights agentic capabilities such as XBOW topping HackerOne's US leaderboard in 2025 and peer-reviewed agents exploiting 87% of one-day flaws unaided. The guide outlines vendor evaluation criteria, including provable work-item coverage, an independent validator agent, and browser-native operation, plus governance guardrails before production use.

The Hacker News10:50 UTC · 3h agoIndustry

When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts

Cloudflare's Page Shield ML uncovered four malicious JavaScript campaigns on storefronts, including affiliate fraud and a remote-backdoor script, that VirusTotal and URLScan missed.

Cloudflare's Page Shield ML detected four client-side JavaScript operations (eight payloads) in live traffic on online storefronts, enabling affiliate commission hijacking, clickless affiliate theft via hidden iframes, user tracking with a remote-code backdoor, and cloaking of paid mobile visitors. Seven of the eight payloads were absent from VirusTotal and URLScan returned no malicious verdict for any, including a Lnkr-family payload indexed unclassified for roughly 2.5 years. Detection relies on a graph neural network over JavaScript syntax trees, an LLM second opinion on Workers AI, and a frontier-model ensemble voting across benign, magecart, other malware, and cryptomining labels.

Cloudflare BlogSep 16, 20:06 UTC · 17h agoMalware in the wild