ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Intruder”

5 stories in the last 24h

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllAdvisory 2Exploit / PoC 1Malware 1Threat actor 1
SeverityAllcritical 1high 1medium 1low 0info 2

CISA Urges Organizations to Deploy Cyber Decoys to Detect Hackers Inside Networks

CISA's new guidance urges organizations to deploy cyber decoys like honeytokens and tripwires to detect attackers using valid credentials and living-off-the-land techniques.

CISA published 'Using Cyber Decoys to Strengthen Detection and Response' on September 16, 2026, advising decoy assets that appear legitimate but generate high-confidence alerts when accessed. It describes tripwires, breadcrumbs, and honeytokens such as fake usernames, passwords, API keys, and cloud access tokens, and recommends starting with low-complexity deployments like nonfunctional Active Directory accounts, decoy file shares, and isolated mimic hosts. The agency warns decoys must be segmented and nonfunctional to prevent attackers pivoting to real systems, and aligns decoy planning with MITRE Engage and ATT&CK.

GBHackers · 1h agoAdvisory

CISA promotes a fresh way to deter cyberattackers: Lie to them

CISA issued first-time guidance advising critical infrastructure operators to deploy honeypots, honeytokens, and decoys to detect and distract intruders.

CISA published 'Using Cyber Decoys to Strengthen Detection and Response,' a 22-page guide marking the agency's first guidance on decoys such as honeypots and honeytokens. Acting executive director Chris Butera described decoys as a low-cost, high-fidelity way to detect adversaries already inside networks, complementing zero-trust and assume-compromise approaches. The guidance covers decoy principles, definitions, deployment scenarios, and is aimed especially at resource-constrained critical infrastructure sectors.

CyberScoop · 16h agoAdvisory

Cisco drops another exploited zero-day, this time a perfect 10new

Cisco's CVSS 10.0 CVE-2026-76460 authentication bypass in Identity Services Engine is actively exploited, granting unauthenticated attackers root command execution.

Cisco disclosed CVE-2026-76460 (CVSS 10.0), an authentication bypass in Identity Services Engine (ISE) and ISE-PIC APIs that gives unauthenticated remote attackers command execution with root privileges; CISA added it to the KEV catalog. It follows CVE-2026-76461 (CVSS 9.8), an actively exploited flaw in Cisco Secure Email Gateway and Secure Email and Web Manager disclosed days earlier. Permanent fixes ship in ISE 3.1 Patch 12 through 3.5 Patch 4; ISE 3.0 is end-of-maintenance and ISE 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 and 3.5 Patch 4 are available. No workaround exists, though ACLs restricting management traffic can serve as temporary mitigation.

The Register · Security · 12m agoExploit / PoC in the wild 21 sourcesCVE-2026-76460CVE-2026-76461

NightEagle Hackers Abuse Microsoft Dev Tunnels and GhostContainer to Breach Russian Companies

NightEagle (APT-Q-95) breached Russian firms using stolen VPN credentials, a GhostContainer Exchange backdoor, Dev Tunnels abuse, and DCSync.

Kaspersky's Securelink analysts, via Securelist, documented NightEagle (APT-Q-95) attacks on Russian companies that begin with VPN logins using stolen valid credentials from Cloudflare WARP and European infrastructure. On Exchange servers the group deployed GhostContainer, a .NET backdoor built from public components including Neo-reGeorg tunneling, CVE-2020-0688 logic, and the GhostWebShell class, controlled through Exchange web headers. The operators exposed RDP through Microsoft Dev Tunnels paired with rdp2tcp, staged tools in GitHub repositories, and exploited BlueKeep (CVE-2019-0708) to create admin accounts before running DCSync against Active Directory.

Cyber Security News · 4h agoThreat actor in the wild 5 sourcesCVE-2020-0688CVE-2019-0708

Hackers Can Rent VectraRAT for $250 a Month to Take Control of Windows PCs

SOCRadar uncovered VectraRAT, a previously undocumented $250-per-month Windows RAT rental service delivered via Amadey and ClickFix lures.

SOCRadar's Threat Research Unit identified VectraRAT, a rental-only remote access trojan sold by a developer known as Vectra (formerly Nyxel), after an exposed online directory revealed samples, licenses, and operator logs across ten-plus servers. The toolkit includes a Linux control server, Windows implant, payload builder, and VectraHub panel, enabling hidden desktop access, keylogging, command execution, credential theft, file transfer, proxying, and silent privilege escalation. Of victims with OS data, 48 percent ran corporate Windows editions, and researchers recorded 38 genuine victim sessions in under a week, including file theft from business systems. Distribution occurs through the Amadey loader and ClickFix pages impersonating TurboTax, with custom TCP-based C2 over non-standard ports.

Cyber Security News · 22h agoMalware in the wild 3 sources