ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “trade”

68 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllPolicy & legal 948Ransomware 623Malware 560Data breach 545Phishing & fraud 484Vulnerability 434Exploit / PoC 369Threat actor 362Industry 298Research 68Advisory 48AI tools & infra 44AI safety & security 41AI research 36
SeverityAllcritical 1693high 1237medium 645low 1163info 184

Windows Malware Detector as a Compound AI System: Trade-Offs in Accuracy, Efficiency, and Adversarial Robustness

Researchers model industrial Windows malware detection as a Compound AI System, quantifying trade-offs between detection accuracy, efficiency, and adversarial robustness under tiered attacker knowledge.

Industrial Windows malware detectors combine rule-based mechanisms with ML-based static and dynamic analyses, but their architectures are rarely publicly disclosed. The authors propose a methodology balancing detection performance, computational cost, and robustness, plus system-level threat models capturing whole-pipeline evasion rather than isolated components. Experiments on real-world data show training time reductions with marginal detection loss, while more knowledgeable attackers craft increasingly effective adversarial examples. The paper derives deployment guidelines from the observed efficiency-robustness trade-off.

arXiv cs.CR · 9d agoResearch1

Identity-as-a-Service: Uncovering Dark Web Marketplaces Trading Executive SSNs

Rapid7 research uncovered dark web marketplaces trading executive Social Security numbers, fueling synthetic identity fraud and unauthorized lines of credit.

Rapid7 threat research documents dark web marketplaces where stolen executive Social Security numbers are bought and sold, a tier of the cybercrime ecosystem more durable than stolen payment cards because SSNs cannot be deactivated. Exposed SSNs enable unauthorized credit lines, synthetic identity fraud, and long-term impersonation. The article cites FTC statistics of over 1 million identity theft reports annually, with related fraud and imposter scams causing billions in losses each year.

Rapid7 Blog · 20d agoResearch

Rootless Docker and Its Hidden Security Trade-Offs

A blog post examines the security trade-offs of running Docker in rootless mode, covering isolation benefits and hidden limitations for defenders.

Ken Muse published a write-up titled 'Rootless Docker and Its Hidden Security Trade-Offs', analyzing the security implications of rootless Docker deployments. The feed provides only the title, so detailed findings are not available in this item, but the piece targets the intersection of containerization and privilege isolation practices.

Lobsters · security · 17d agoResearch1

A Feature-Rich Embedded NIDS with eBPF/XDP: Detector and Architecture Trade-offs

eBPF/XDP-based NIDS with Isolation Forest reaches 0.965 live F1 on DDoS replay; gRPC microservices match monolithic accuracy within 2ms overhead.

The paper presents a DDoS-focused network intrusion detection system for transport networks built with Ericsson, combining a statistical baseline with an Isolation Forest trained on flow features from GoFlowMeter, an open-source Go implementation of CICFlowMeter, plus eBPF/XDP kernel-level traffic filtering. On a Raspberry Pi 5 testbed replaying CIC-DDoS2019 as real traffic, the Isolation Forest achieves 0.965 recall/F1 live in the monolithic variant, catching low-volume attack windows the baseline misses. gRPC microservices nearly match monolithic accuracy adding under 2ms per window, while the Kafka pipeline trails by roughly nine percentage points and adds about 27ms.

arXiv cs.CR · 5d agoResearch

Meme Coin Factories: Uncovering Large-Scale Manipulations on pump.fun

Large-scale pump.fun study of 15 million meme coins identifies five manipulation classes including wash trading and a Market-Manipulation-as-a-Service ecosystem.

Researchers analyzed all 15 million coins launched on pump.fun over the last two years plus large random samples of transaction data, identifying five manipulation classes: wash trading, creator address obfuscation, coordinated sells, copycat coins, and social media manipulation. Strategic actors bypass the platform interface and implement strategies in a highly automated, low-latency way by interacting directly with the blockchain. The study also uncovers Market-Manipulation-as-a-Service (MMaaS) third-party tools that let non-technical users run these manipulations, and proposes mitigations for traders, pump.fun, and regulators.

arXiv cs.CR · 7d agoResearch

Differentially Private EEG Feature Anonymization: A Privacy-Utility Case Study in Clinical Neurophysiology

Case study applies Gaussian and Laplace differential privacy to clinical EEG features, quantifying privacy-utility trade-offs across three deployment scenarios.

Researchers evaluate subject-level differential privacy for EEG-derived feature representations using Gaussian and Laplace perturbations across client-side, centralized server-side, and decentralized local training scenarios. Utility is assessed with statistical measures and a downstream machine-learning check on clinical neurophysiology data. Results show DP can be integrated into EEG workflows, but mechanism choice, privacy parameters, and sensitivity calibration strongly influence data utility, particularly on small and imbalanced clinical datasets. The study highlights the privacy-utility trade-off in protecting biomedical signals against re-identification and inference risks.

arXiv cs.CR · 6d agoResearch

Understanding the Privacy-Preserving Potential of HTTP/2 Against Webpage Fingerprinting

Researchers show HTTP/2 features can emulate website fingerprinting defenses like FRONT and Tamaraw with tunable privacy-overhead trade-offs.

An arXiv paper demonstrates that application-layer defenses such as HTTPOS, LLaMA, FRONT, ALPaCA, and Tamaraw can be emulated through HTTP/2 features at both the client and server side, including proactive resource suggestion, multiplexing, and flow control. The authors propose a unified evaluation blueprint that calibrates defense parameters per dataset, combines practical attacks with information-theoretic leakage estimators, and measures overheads to map each defense's privacy-overhead trade-offs.

arXiv cs.CR · 12d agoResearch

Locus: A Framework for Exploring and Optimizing Point Addition Hardware for Zero-Knowledge Proofs

Locus framework automates ASIC and FPGA point-addition designs for elliptic curves, achieving 2.71x speedups and 3.11x area reductions for ZKPs.

Locus is a framework that automatically generates ASIC and FPGA implementations of elliptic curve point addition (PADD) for supported equation forms, enabling exploration of over 1,000 design points. On a 12nm technology node, its designs achieve a 2.71x geomean speedup and 3.11x geomean area reduction versus prior ASICs, plus 34.67x geomean speedup over CPU. Integrated into a prior ZKP accelerator at iso-area, it yields a 3.15x geomean speedup on end-to-end proof generation. The framework is open source on GitHub.

arXiv cs.CR · 16h agoResearch

A battery storage cyberattack would look exactly like a badly tuned controller

Risk modeling suggests a few hundred compromised grid-scale batteries dispatched through cloud optimizers could trigger blackouts in Texas or Great Britain.

Centrii analysis estimates 1,500 compromised one-megawatt units (5.4% of ERCOT's ~28 GW fleet) or 400 units (about 29% of Great Britain's ~1,400-unit fleet) could destabilize the grids, with modeled damage of $12-65 billion in Texas and a national blackout costing £2-10 billion in Britain. The study puts the probability of a major attack affecting at least one million people by 2031 at 92.1%, dropping to 61.4% with IEC 62443 certification and quarterly drills, based on 10,000 Monte Carlo runs. Because hostile battery swings are phased like legitimate frequency response, control rooms would see nothing unusual; Centrii proposes hunting for a reverse-governor signature where inverter output feeds oscillations. Spain's April 2025 blackout took an expert panel until March 2026 to rule out cyberattack, partly because key plants had no recordings.

Help Net Security · 15d agoResearch

SEEK: Secure and Efficient Encrypted Keyword Search For Privacy-Preserving Messaging Protocols

Researchers propose SEEK, a homomorphic-encryption plus 2PC protocol for encrypted keyword search that hides keywords while detecting matches.

SEEK partitions messages into ciphertext fragments with minimum sufficient overlap and homomorphically correlates them using encrypted keyword trapdoors, combined with 2PC-based selected decoding, blinded zero testing, and secure aggregation. It reduces sender-side encryption and upload overhead by up to two orders of magnitude over state-of-the-art baselines and computes correlations up to 5.47x faster, revealing only the keyword presence bit while hiding contents, counts, and locations. A prototype achieves 1.92 seconds online computation per search on a weekly messaging history and is realized as a web and cross-platform mobile application.

arXiv cs.CR · 21h agoResearch

DDRop Attack Forces Intel TDX Confidential VMs Into Debug Mode and Exposes Memory

KU Leuven and ETH Zurich researchers released DDRop PoC hardware that forces Intel TDX confidential VMs into debug mode and exposes plaintext memory.

Researchers from KU Leuven, ETH Zurich, Google, and Durham University published proof-of-concept code, hardware designs, and firmware for DDRop, a DDR5 interposer that injects parity errors to drop selected cache-line writebacks. Because Intel TDX, Intel Scalable SGX, and AMD SEV-SNP lack per-line cryptographic freshness, processors decrypt and accept stale DRAM contents as current state. The PoC flips a victim's ATTRIBUTES.DEBUG flag to enable TDX debug mode, then copies victim memory in plaintext and can forge attestation reports. Affected environments include Intel 5th- and 6th-generation Xeon Scalable with TDX; Intel says the attack falls outside its cloud-computing threat model.

GBHackers · 1d agoResearch

From Hypervisor to Container: Cloud Security Vulnerabilities, Defense Mechanisms, and Open Challenges

Survey of 120+ cloud security papers (2008-2025) reviews hypervisor and container isolation attacks, scoring defenses with the ADPO framework and CIA impact scale.

This survey reviews over 120 security publications from 2008 to 2025 on breaches of cloud isolation boundaries via virtual machines and containers. Threats examined include VM escape, VM hopping, CPU cache side-channels, container breakouts, vulnerable container images, and DDoS attacks. The authors introduce ADPO, a 0-3 scoring framework rating defenses on accuracy, deployment ease, performance impact, and operational overhead, plus a 1-5 CIA severity mapping for attack impact.

arXiv cs.CR · 2d agoResearch

New hardware device can RAM into encrypted memory, expose your data

Researchers built a $200 DDR5 interposer that silently drops memory writes to break TDX, SGX, and SEV-SNP confidential VM integrity, requiring physical access.

Researchers from KU Leuven, ETH Zurich, Durham University, and Google demonstrated DDRop, a hardware interposer costing under $200 that corrupts DDR5 bus commands to silently drop writes to encrypted memory, enabling replay attacks on confidential VMs. Because scalable memory encryption lacks freshness checks, protected VMs keep computing on stale attacker-selected data; on an Intel TDX server the attack forces debug mode for plaintext memory reads or forges attestation reports, succeeding in under two minutes without crashing. Intel and AMD both called the attack out of scope for their cloud threat models, with no mitigation planned, and proposed cache line versioning appears still vulnerable. The full interposer design is being released as open-source hardware.

The Register · Security · 2d agoResearch

Credential Theft: How Attackers Steal & Use Stolen Credentials

Huntress explains how attackers steal credentials through phishing, AitM, infostealers, and dumping, then use them for lateral movement, BEC, and ransomware.

Huntress published an educational overview of credential theft, citing that roughly 70% of confirmed data breaches begin with stolen credentials. It details acquisition methods including phishing, adversary-in-the-middle attacks that capture MFA session tokens, infostealers (nearly a quarter of threats Huntress observed in 2025), Mimikatz-based credential dumping, credential stuffing, and password spraying. The piece then covers post-theft actions such as lateral movement, privilege escalation, account takeover, business email compromise, and ransomware, and closes with behavioral detection guidance and layered prevention strategies.

Huntress · 6d agoResearch

Getting ahead of ‘harvest-now-decrypt-later’: Post-quantum cryptography planning

Opinion piece urges organizations to begin post-quantum cryptography migration now, citing harvest-now-decrypt-later risk and NIST deadlines.

CSO Online outlines why harvest-now-decrypt-later makes long-lived sensitive data a current risk even before quantum computers exist. It cites NIST IR 8547 timelines deprecating RSA-2048 and ECC P-256 by 2030 and removing them by 2035, finalized FIPS standards ML-KEM, ML-DSA, and SLH-DSA, upcoming FN-DSA (FIPS 206), NSA requirements for national security systems from 2027, and UK NCSC phased guidance through 2035. The author recommends cryptographic discovery, crypto-agility, and prioritizing long-confidentiality data and TLS endpoints.

CSO Online · 6d agoResearch

Hunting Vulnerabilities Using Frontier Models

Okta used frontier AI models GPT-5.5 Cyber and Mythos via OpenAI and Anthropic programs to scan millions of code lines for vulnerabilities.

Okta describes using frontier AI models, including GPT-5.5 Cyber Preview (TAC) and Mythos Preview, through OpenAI's Daybreak Cyber Partner Program and Anthropic's Project Glasswing to hunt vulnerabilities across its product codebase. The team built a custom Python orchestrator with strong isolation, vendor-agnostic model support, and four distinct scanning pipelines executed as isolated Codex or Claude Code sessions with progressive context loading to reduce context bloat. Human experts and AI agents worked both autonomously and in paired hunts, and Okta reports the best results when humans and agents taught each other.

Okta Security · 9d agoResearch

8,539 Reasons To Rethink How Vulnerabilities Get Patched

Rapid7 counted 8,539 high and critical CVEs in Q2 2026, double last year, with PoC availability up 76%.

Rapid7's Q2 2026 Threat Landscape Report tallied 8,539 high- and critical-severity vulnerability disclosures, twice the number recorded in Q2 2025, with newly disclosed flaws having public proof-of-concept code up 76% year over year. Of newly exploited vulnerabilities, 62% were network-exploitable and required neither authentication nor user interaction. Fake CAPTCHA and ClickFix social engineering accounted for 31.8% of incident response cases, the United States recorded 881 listed ransomware victims, and APT28 exploited SOHO routers for DNS hijacking while Iranian groups targeted US industrial control and OT systems.

Help Net Security · 28d agoResearch