Search: “power management”

5 stories in the last 24h

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Threat actor 6 Data breach 5 AI industry 5 Vulnerability 4 Malware 4 Exploit / PoC 3 AI safety & security 3 Advisory 3 Industry 3 Policy & legal 2 AI tools & infra 1 AI policy 1

SeverityAll critical 4 high 10 medium 12 low 2 info 12

North Korean IT Workers Use AI and Remote Desktop Tools to Fake Technical Interviews

Silent Push links a Discord recruitment scheme to North Korean IT workers using AI, remote desktop tools and on-camera proxies to pass technical interviews.

Silent Push assessed with moderate-to-high confidence that a representative known as Tec Guru, recruiting on-camera proxies via a Mouse Review Discord advertisement, is a North Korean IT worker. The scheme proposed a 65/35 revenue split with the hidden worker, live coaching through Google Meet, AI tools including ChatGPT to fill knowledge gaps, and remote access tools such as AnyDesk, TeamViewer, and Chrome Remote Desktop during coding exercises. Fraudulent hires can gain insider access enabling data theft, extortion, payroll fraud, and sanctions exposure; a July 31, 2026 multinational warning urged stronger identity checks and payment scrutiny.

Cyber Security Newsupdated 12:51 UTC · 1h agofirst 11:56 UTC · 2h agoThreat actor 2 sources

BlackHatSect0r Hackers Disable AI Safety Controls to Automate Credential Theft and Cyberattacks

French-speaking crew BlackHatSect0r disabled AI agent safety controls to automate scanning, credential harvesting, and vishing, exposing 16,834 stolen credentials.

Socradar researchers analyzed the exposed infrastructure of a French-speaking crew called BlackHatSect0r && DXQRTXX, which ran a Nous Research Hermes agent on a DeepSeek model with safety controls removed via HERMES_DISABLE_SAFETY=1. A custom Go-based C2 platform, DXSCAN, was exposed on port 8080 with over 200 secret-detection patterns, a vault of 16,834 harvested credentials, and scanning activity queuing 2.75 million domains and reaching more than 726,000 hosts. The kit also held a database of roughly 450,000 French telecom subscriber records used to prepare vishing lures impersonating Société Générale, plus JWT-forging tooling for a cryptocurrency exchange. Most confirmed compromises relied on exposed secrets and cloud misconfiguration rather than novel exploits; the one cited vulnerability, CVE-2026-42530, is an NGINX HTTP/3 QPACK use-after-free fixed in version 1.31.2.

GBHackersupdated 09:59 UTC · 4h agofirst 07:00 UTC · 7h agoThreat actor in the wild 4 sources CVE-2026-42530

Handala Hack Uses CRUDEEXCLUDE to Disable Defender Protections and Deploy HEAVYGRAMnew

Group-IB links new HEAVYGRAM and CRUDEEXCLUDE malware to Iran-aligned Handala Hack (MOIS/Void Manticore), which spies on Iranian dissidents using Defender exclusions and Telegram C2.

Group-IB documented previously unreported HEAVYGRAM and CRUDEEXCLUDE malware linked with moderate confidence to the Iran-aligned Handala Hack, assessed as a MOIS-linked persona tied to Void Manticore (Storm-0842, Banished Kitten, Red Sandstorm). CRUDEEXCLUDE uses PowerShell to add attacker-controlled Microsoft Defender exclusions, then a Delphi-based loader deploys a PyInstaller-packaged HEAVYGRAM implant that abuses Telegram bot APIs for command-and-control, shell execution, screenshots, audio recording, and Telegram Desktop data theft. The campaign targets Iranian dissidents, journalists, and academics with fake KeePass, Telegram, WhatsApp, and Pictory installers. The DOJ seized four related domains in March 2026 and the FBI published a HEAVYGRAM FLASH report on September 15.

GBHackers13:46 UTC · 14m agoThreat actor in the wild 9 sources

NightEagle Hackers Abuse Microsoft Dev Tunnels and GhostContainer to Breach Russian Companies

NightEagle (APT-Q-95) breached Russian firms using stolen VPN credentials, a GhostContainer Exchange backdoor, Dev Tunnels abuse, and DCSync.

Kaspersky's Securelink analysts, via Securelist, documented NightEagle (APT-Q-95) attacks on Russian companies that begin with VPN logins using stolen valid credentials from Cloudflare WARP and European infrastructure. On Exchange servers the group deployed GhostContainer, a .NET backdoor built from public components including Neo-reGeorg tunneling, CVE-2020-0688 logic, and the GhostWebShell class, controlled through Exchange web headers. The operators exposed RDP through Microsoft Dev Tunnels paired with rdp2tcp, staged tools in GitHub repositories, and exploited BlueKeep (CVE-2019-0708) to create admin accounts before running DCSync against Active Directory.

Cyber Security News07:55 UTC · 6h agoThreat actor in the wild 5 sources CVE-2020-0688 CVE-2019-0708

SilkParasite-Linked Malware Infrastructure Traced Back Four Years Across Central Asia

Hunt.io links SpiceRAT C2 servers to China-nexus SilkParasite espionage targeting Central Asian governments, with related infrastructure active since 2022.

Hunt.io and researcher Guy Yasur traced a cluster of SpiceRAT command-and-control servers active from late 2025 to August 2026 to infrastructure linked to the China-nexus SilkParasite espionage operation. Shared parent domains, a certificate resembling an Uzbek railway entity, and a cloned RTX Corporation homepage appearing on 13 servers connect SpiceRAT systems to NodeEdgeRAT and NomadRAT infrastructure. Passive DNS records show related subdomains as early as mid-2022, suggesting the infrastructure has existed for at least four years. Hostnames impersonate government, energy and telecom targets across Turkmenistan, Tajikistan, Uzbekistan, Kyrgyzstan and Kazakhstan.

Cyber Security Newsupdated 13:12 UTC · 47m agofirst 12:26 UTC · 1h agoThreat actor in the wild 2 sources