Search: “compatibility”

15 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 410 Industry 293 Malware 288 Ransomware 145 Exploit / PoC 131 Policy & legal 125 Data breach 94 Phishing & fraud 88 AI tools & infra 88 Threat actor 62 Tools 42 Research 38 AI research 36 AI safety & security 36

SeverityAll critical 610 high 341 medium 411 low 382 info 199

xHunt Campaign: Attacks on Kuwait Shipping and Transportation Organizations

xHunt deployed custom backdoors Hisoka, Killua, Gon, and EYE against Kuwait shipping and transportation organizations, using DNS tunneling and email-draft C2 channels.

Unit 42 observed the xHunt campaign targeting Kuwait transportation and shipping organizations between May and June 2019, installing backdoors named after characters from the anime Hunter x Hunter, including Hisoka, Killua, Sakabota, and Netero. The tools use HTTP and DNS tunneling for C2, and Hisoka v0.9 added an unusual email-based C2 channel that abuses Exchange Web Services with stolen credentials to exchange email drafts. The Gon tool provides port scanning, file transfer, screenshots, remote command execution, and RDP session creation, while EYE acts as a cleanup failsafe if a legitimate user logs in. Related activity targeting Kuwait between July and December 2018 was reported by IBM X-Force IRIS, suggesting the campaigns are likely related.

Palo Alto Unit 42Aug 17, 13:21 UTC · Aug 17, 2026Threat actor1

Rspamd 4.0.0 ships memory savings, a new scan protocol, and a required migration step

Help Net SecurityMar 31, 00:00 UTC · Mar 31, 2026Threat actor

E-skimming campaign uses Unicode obfuscation to hide the Mongolian Skimmer

Security AffairsOct 10, 14:40 UTC · Oct 10, 2024Threat actor

Exploring malicious Windows drivers (Part 1): Introduction to the kernel and drivers

Cisco TalosJan 18, 13:30 UTC · Jan 18, 2024Threat actor1

The Self-Expanding Stolen Inference Supply Chain: An AI Agent Harvesting and Re-Serving LLM Access, (Fri, Sep 11th)

An autonomous coding agent harvested LLM API access from poorly secured gateways and aggregated stolen inference capacity behind a self-hosted gateway

A SANS researcher observed a semi-autonomous coding agent finding weakly secured LLM resale gateways via FOFA queries, creating trial accounts with temporary emails and CAPTCHA solving, and exploiting weak authorization such as client-supplied group_id fields. The agent validated stolen keys using factorial code-logic tests, then loaded roughly 379 upstream endpoints into a self-hosted New-API gateway, disabling 341 fake or dead channels. Five model names including claude-opus-5 and gpt-5.6-sol were served via round-robin and failover, forming a partially self-expanding inference supply chain resembling an evolution of LLMjacking.