ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “HTTP Terminator”

120 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllExploit / PoC 33Malware 26Ransomware 19Vulnerability 18Threat actor 17Data breach 3Model release 2AI safety & security 1Phishing & fraud 1Advisory 1
SeverityAllcritical 85high 29medium 5low 0info 2

China-Linked Fire Ant Hijacks Cisco Routers to Steal Credentials and Blind Security Logs

China-nexus espionage group Fire Ant compromised Cisco IOS XR routers and TACACS servers to harvest credentials, capture traffic and suppress logs.

Sygnia investigated an intrusion in which Fire Ant expanded beyond VMware hypervisors to Cisco IOS XR routers, TACACS servers and Linux management hosts. The actor deployed purpose-built router implants that hid a GRE tunnel, filtered log messages, captured PCAPs uploaded to external FTP servers, and used TacTap to inject a library into tac_plus and steal TACACS credentials obfuscated with a single-byte XOR key of 0xEF. A Linux backdoor named BridgeAgent masqueraded as a Zabbix agent, persisted via a root systemd unit, disguised itself as /usr/bin/gnome-shell and received commands over TLS on port 443. The group also used Medusa and REPTILE rootkits, SSH backdoors and renamed binaries impersonating SentinelOne and Cybereason agents, while suppressing logs, disabling SELinux and rewriting login history. Sygnia assesses strong overlap with UNC3886 and published IoCs.

The Hacker News · 16d agoThreat actor in the wild1

CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners

CISA added seven actively exploited vulnerabilities to its KEV catalog, including SonicWall SMA 1000 SSRF CVE-2026-83548, amid campaigns deploying reverse shells and crypto miners.

CISA's KEV additions cover flaws in SonicWall SMA 1000 (CVE-2026-83548, CVE-2026-83549), Sangoma Switchvox (CVE-2026-9586), JFrog Artifactory (CVE-2026-82329), Kludex Starlette (CVE-2026-48710), Kestra OSS (CVE-2026-49869) and Berri LiteLLM's MCP endpoint (CVE-2026-59822). SonicWall confirmed active exploitation of the SMA 1000 flaws, while Microsoft and Wiz reported attackers chaining LiteLLM flaws CVE-2026-42271 and CVE-2026-48710 to fingerprint hosts, steal provider API keys and deploy XMRig miners on AI infrastructure. Wiz linked exploitation of the LiteLLM chain to the Qilin ransomware group, and Microsoft detailed a Kestra compromise chain ending in cryptocurrency mining and data harvesting via exposed RAGFlow flaws.

The Hacker News · 13d agoExploit / PoC in the wildCVE-2026-83548CVE-2026-83549CVE-2026-9586+10 CVEs1

The Coding-Agent Trap: When a "Free" LLM Endpoint Is the Adversary, (Mon, Aug 31st)

A SANS honeypot caught a real coding-agent session routed to a rogue "free" LLM endpoint, exposing a Windows user's transcript and tool outputs.

A SANS analyst describes how an internet-exposed inference honeypot was discovered, relabeled with sought-after model names like DeepSeek, and enrolled in infrastructure serving "free" LLM backends. On 2026-08-30 an opencode terminal coding agent sent an 88-message, 224 KB transcript 210 times in 91 seconds via a China Unicom relay, exposing directory listings, tool outputs and read file portions. The analyst frames tool-enabled agents treating model endpoints as trusted control planes as a novel risk — a "rogue model endpoint" that could request tool executions on the user's machine.

SANS Internet Storm Center · 16d agoAI safety & security1

SilkParasite Espionage Campaign Targets Central Asian Governments with Five New RATs

Bitdefender reports SilkParasite, a China-nexus espionage cluster targeting Central Asian governments with seven RATs, five newly documented, delivered via spearphished RAR archives.

Bitdefender Labs assesses with medium confidence that SilkParasite, first discovered in late 2025, is a China-nexus cluster targeting government bodies in Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, Kazakhstan, and Georgia. Attacks use password-protected RAR archives with malicious Office documents, macro-triggered DLL sideloading, and checks for running Kaspersky AV before execution. The arsenal spans seven RAT families in .NET, C++, Go, and JavaScript with plugin architectures and diverse C2 channels including Google Drive and HTTP cookie/ETag headers; roughly 65 DriveSilkRAT infections were observed, mostly in Asia. Ties to China include BLOODALCHEMY (a Deed RAT/ShadowPad descendant) and an improved SpiceRAT used by SneakyChef, with traces of AI-assisted development in the tooling and lures.

The Hacker News · 27d agoThreat actor in the wild

KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens

Elastic Security Labs details KREMLIN, Brazilian banking malware using malicious Chrome/Edge extensions and Ethereum smart contracts to steal credentials and session tokens.

Elastic Security Labs documents KREMLIN (tracked as REF9334), a Brazilian banking malware toolkit active since at least May 2025 that impersonates a dozen Brazilian banks. It uses multi-stage JavaScript loaders, a C++ installer that DLL-sideloads via a legitimate SentinelOne binary, and a malicious Chrome/Edge extension named 'AVSync System Inc.' Ethereum smart contracts act as dead-drop resolvers for C2 endpoints, a shift that occurred May 19, 2026, making infrastructure hard to disrupt. The extension harvests cookies, sessionStorage/localStorage, browsing history, screenshots, and full page HTML via WebSocket plus CSS-disguised polling endpoints. The group has run seven distinct campaigns and also distributes Pulsar RAT and Remcos RAT.

The Hacker Newsupdated · 15h agofirst · 1d agoMalware in the wild 2 sources

StyleSmuggler: Magento and Adobe Commerce 0-day RCE (CVE-2026-75650) under active attack

Sansec details actively exploited StyleSmuggler 0-day (CVE-2026-75650, CVSS 10.0) unauthenticated RCE in Magento and Adobe Commerce, patched by Adobe hotfix APSB26-146.

Sansec is investigating StyleSmuggler, an actively exploited unauthenticated remote code execution chain in Magento Open Source and Adobe Commerce, now tracked as CVE-2026-75650 with CVSS 10.0. Adobe released hotfix VULN-39341 via APSB26-146 (priority 1) on September 7 for versions 2.4.4 through 2.4.9, but stores were being exploited for roughly three days before the fix existed. The implant is a Rust backdoor that disguises itself as kworker, fc-cache, or chronyd processes and exfiltrates host data in MessagePack records sent as fake NTP replies over UDP port 123. Adobe advises rotating the encryption key and every credential it protected, and Sansec stresses patching does not clean already-compromised stores.

Sansec (Magento / e-commerce security) · 11d agoExploit / PoC in the wildCVE-2026-756501

Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers

Kaspersky details NightEagle, Hacking Cat, and Toy Ghouls targeting Russian enterprises with Exchange backdoors, Gorilla RAT, and destructive Monkey ransomware.

Kaspersky reports three threat clusters targeting Russian enterprises: NightEagle (APT-Q-95), the pro-Ukrainian hacktivist group Hacking Cat, and Toy Ghouls. NightEagle uses compromised VPN credentials and the GhostContainer modular backdoor to fully compromise Microsoft Exchange servers, chaining CVE-2020-0688 exploitation, BlueKeep (CVE-2019-0708), Active Directory vulnerabilities, and DCSync to seize domain controllers. Hacking Cat exploits Exchange flaws including CVE-2021-26855 and CVE-2026-42897 to deliver the Gorilla RAT and multiple Monkey ransomware variants written in Rust, .NET, C++, and Golang targeting Windows, Linux, and VMware ESXi, with some variants acting as wipers that never store the encryption key.

The Hacker News · 5h agoThreat actor in the wild 2 sourcesCVE-2020-0688CVE-2019-0708CVE-2021-26855+1 CVEs

China's AI-Enabled APT Operations Are Getting Interesting

Bitdefender links seven RAT families, five previously undocumented, to China-nexus espionage actor SilkParasite using AI-assisted malware development against Central Asian governments.

A Bitdefender report attributes seven remote access tool families to a single actor dubbed SilkParasite, with medium confidence a China-nexus group targeting governments in Uzbekistan, Turkmenistan and Kazakhstan. The RATs are written in .NET, C++, Go and JavaScript, use C2 via Google Drive and protocols like HTTP, DNS and TCP, and employ modular plugin architectures with regular rotation of infrastructure, encryption material and persistence artifacts. Evidence of AI-assisted development includes leftover test functions, placeholder encryption keys, and GoginRAT and NomadRAT sharing a high-level architecture despite different languages, suggesting a specification implemented twice with AI. The newsletter also covers the US Operation Economic Outcast sanctioning six MOIS-linked Iranian hackers, including hands-on-keyboard operators who targeted US critical infrastructure.

Risky Business News · 20d agoThreat actor1