Search: “sql”

10 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 771 Ransomware 315 Exploit / PoC 257 Data breach 199 Malware 165 Industry 94 Policy & legal 64 Threat actor 62 AI tools & infra 38 Advisory 34 Phishing & fraud 21 Tools 20 AI safety & security 19 Research 14

SeverityAll critical 970 high 559 medium 315 low 169 info 80

Threat actors target poorly protected Microsoft SQL Servers

Security AffairsFeb 22, 21:32 UTC · Feb 22, 2022Threat actor1

Thousands of Humana customers have their medical data leaked online by threat actors

Security AffairsJul 22, 05:42 UTC · Jul 22, 2021Threat actor

RedJuliett Cyber Espionage Campaign Hits 75 Taiwanese Organizations

The Hacker NewsJun 25, 04:52 UTC · Jun 25, 2024Threat actor CVE-2016-5195

Threat Actor Breaches Snowflake Customers, Victims Extorted

Infosecurity MagazineJun 11, 14:35 UTC · Jun 11, 2024Threat actor

New Horabot campaign targets the Americas

Cisco TalosJun 1, 12:00 UTC · Jun 1, 2023Threat actor

Attackers impersonate popular AI brands to spread malware

Sophos documented 38 MDR cases where attackers impersonated AI brands like Claude and Perplexity to deliver infostealers and backdoors.

Sophos X-Ops analyzed 12 months of MDR cases and confirmed 38 incidents involving AI. Software impersonation accounted for 30 cases, with Claude impersonated in 26; fake installers used an 'InstallFix' technique delivering mshta commands, in-memory payloads, and process hollowing. Malicious browser extensions posing as AI assistants, including a fake Perplexity extension with 10,000 installs, acted as infostealers. In one case, attackers used a Claude coding agent to develop a Rust remote access trojan communicating over Slack after an SQL injection compromise.

Help Net SecurityAug 21, 00:00 UTC · 26d agoThreat actor in the wild

Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic

Kaspersky details Iranian Cavern Manticore's expanded C2 framework using DNS and Google Apps Script, plus APT42's TAMECAT spyware in nuclear-sector phishing.

Kaspersky reported new components in the Cavern (Cav3rn) C2 framework, used by Iranian MOIS-affiliated Cavern Manticore (with overlaps to MuddyWater and OilRig's Lyceum) against Israeli entities, monitored since December 2025. The new GoogleService.dll module performs DNS A-record queries to choose between direct HTTPS and a Google Apps Script relay per transaction, with the DNS infrastructure able to rotate the Google deployment ID; Kaspersky also found an inter-component broker (rnp.dll) and linked the framework's plugin-based pivot to late April 2026. Separately, Group-IB and Kaspersky detailed HOLLOWGRAPH, a .NET NativeAOT DLL first seen in the wild June 7, 2026, that uses Microsoft 365 calendar events via the Graph API as two-way dead drops dated May 13, 2050, with DNS tunneling refreshing Entra ID credentials. DarkAtlas also reported APT42's TAMECAT modular surveillance framework delivered via LNK masquerading as PDFs in spear-phishing targeting the nuclear energy sector in April-May 2026, with the group using generative AI to accelerate operations.

The Hacker NewsAug 18, 12:12 UTC · 29d agoThreat actor