ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “mount”

27 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 429Malware 360Ransomware 338Threat actor 179Exploit / PoC 160Policy & legal 152Data breach 132Industry 120Phishing & fraud 96Research 26AI safety & security 18AI tools & infra 14Advisory 11AI industry 8
SeverityAllcritical 743high 624medium 387low 255info 51

Iranian Hackers Pose as Recruiters to Deliver Cross

Kaspersky attributes new cross-platform RATs NodeRabbit and PollCat to Iranian group Nimbus Manticore, spread via recruiter-themed LinkedIn lures.

Kaspersky links two previously undocumented malware families, NodeRabbit (Node.js) and PollCat (obfuscated JavaScript), to the Iranian threat actor Nimbus Manticore, also known as Iranian Dream Job. Victims in Afghanistan, Egypt, and Ethiopia received trojanized coding challenge archives containing fake npm packages (colorized_terminal, pretty-log) that silently launched the RATs as background processes. NodeRabbit contacts Azure-hosted C2 servers via checkin, task, and result API endpoints and supports 11 commands including shell execution, file operations, and network enumeration. Persistence is platform-specific: Windows Run keys or scheduled tasks, Linux cron entries, and macOS launch agents, impersonating Microsoft Edge updates or Intel's Driver & Support Assistant.

The Hacker News · 14d agoThreat actor

Suspected Iran-linked attack knocked UK power plant offline for days

Suspected Iranian hackers knocked a small UK power plant offline for four days in July 2026, with no noticeable impact on the national grid.

Sources told The Telegraph that a British power plant was offline for four days in July 2026 following a suspected Iranian cyberattack, reported to the National Cyber Security Centre. The UK energy minister said the incident affected a small-scale energy generator with no noticeable effect on the power supply, and energy CEOs were briefed and given further advice afterward. The attack followed warnings about Iranian cyber activity against US energy, water, and government networks, including a coordinated attack on 30+ US community water utilities.

Help Net Security · 24d agoThreat actor

New Python-Based Payload MechaFlounder Used by Chafer

Unit 42 identified MechaFlounder, a new Python backdoor used by the Chafer group to target a Turkish government entity via HTTP-based C2.

Unit 42 reports that in November 2018 the Chafer group targeted a Turkish government entity, reusing the win10-update[.]com infrastructure reported earlier in 2018 by ClearSky. The new secondary payload, tracked as MechaFlounder, is Python compiled with PyInstaller and acts as a backdoor supporting file upload/download and command execution. It beacons over HTTP using anomalous GET requests containing the username and hostname, suggesting a custom C2 server rather than a standard web server. Code overlap with OilRig's Clayside VBScript was noted, but Chafer and OilRig remain tracked as separate groups.

Palo Alto Unit 42 · Aug 17, 2026Threat actor