Search: “DysruptionHub”

ZDI-26-628: Backblaze Personal Computer Backup bzreports Link Following Denial-of-Service Vulnerability

ZDI disclosed CVE-2026-19820, a CVSS 6.1 local link-following denial-of-service flaw in the bzreports component of Backblaze Personal Computer Backup.

The Zero Day Initiative published advisory ZDI-26-628 for a denial-of-service vulnerability in Backblaze Personal Computer Backup's bzreports component. A local attacker must first obtain the ability to execute low-privileged code on the system to exploit the link-following flaw. ZDI rated the issue CVSS 6.1 and assigned CVE-2026-19820.

ZDI Published Advisories·Sep 9, 05:00 UTC · 7d agoAdvisory 5 sourcesCVE-2026-19820

GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure

GitLab patched CVE-2026-85706, a CVSS 10.0 unauthenticated path traversal enabling arbitrary file reads, already probed in the wild.

GitLab released patches for a maximum-severity path traversal flaw (CVE-2026-85706, CVSS 10.0) in the repository commits API, caused by improper path confinement and missing authentication enforcement, allowing unauthenticated arbitrary file reads. watchTowr observed active in-the-wild probes starting 06:00 UTC on September 11, 2026; exploitation requires at least one public project and enables theft of credentials, secrets, and configuration data. GitLab also patched CVE-2026-87719 (CVSS 9.9), an insecure deserialization bug in Enterprise Edition allowing authenticated Duo Chat users to access Advanced Search configurations and sensitive credentials via crafted GraphQL subscription arguments. Affected versions include 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2, and the flaw follows the recently exploited GraphQL code injection bug CVE-2026-19478.

The Hacker News·updated Sep 15, 00:52 UTC · 1d ago·first Sep 11, 16:30 UTC · 4d agoExploit / PoC in the wild 17 sourcesCVE-2026-85706CVE-2026-87719CVE-2026-194781

Risky Bulletin: BEC campaign steals €35 million from French notaries

Hackers stole over €35 million from 500+ French notary offices in a four-year BEC campaign; ANSSI spent two years helping evict the attackers.

A business email compromise campaign breached more than 500 French notary offices — about 7% of all French notaries per the Conseil Supérieur du Notariat — over four years, stealing more than €35 million by phishing initial access and silently modifying wire transfer details. France's cybersecurity agency ANSSI worked for two years behind the scenes to help notaries remove the persistent attackers, who had deep access; officials also feared hackers could issue fake notarized acts such as marriage certificates or forged real estate deals. No forged documents have been found so far, but notaries have added two-factor authentication and in-person requirements for banking details, and banks added extra checks in 2024. The newsletter also notes other incidents, including a $320 million Bitcoin extraction from Blockstream's Liquid Network and a JetBrains Cadence breach via TeamCity servers.

Risky Business News·Sep 7, 03:42 UTC · 9d agoPhishing & fraud in the wild1

Ransomware group claims attack on Missouri’s Cedar County Memorial Hospital after IT outage

Ransomware group claims attack on Cedar County Memorial Hospital in Missouri, forcing IT shutdown that disrupted EHRs and diverted emergency patients.

Cedar County Memorial Hospital in El Dorado Springs, Missouri shut down its IT networks on August 14 after a disruption left its electronic health record system, patient portal, and internet access unavailable. A ransomware group subsequently claimed responsibility for the attack. Diagnostic imaging was also disrupted, preventing transmission of images to radiologists, and the emergency department partially diverted trauma and critical patients.

DataBreaches.net·Sep 15, 11:49 UTC · 1d agoRansomware

Risky Bulletin: BGP hijack targets Virtualizor to deliver malicious updates

Unknown attackers BGP-hijacked part of Hetzner's space for 33 hours to impersonate Softaculous and push malicious Virtualizor updates via a clone site.

On 28 August 2026, AS62390 (NexonHost) began announcing 162.55.80.0/24 — part of Hetzner's 162.55.0.0/16 containing Softaculous systems — via transit AS6204 (Zet.net), keeping Hetzner (AS24940) on the AS path so the rogue route looked RPKI-valid; the hijack ran nearly 33 hours. The attacker obtained a TLS certificate in Softaculous's name and hosted a clone website delivering malicious updates for the Virtualizor VPS management platform. Virtualizor cannot measure impact because hijacked traffic never touched its infrastructure, and warns users who paid during the attack may have had financial data stolen; no attribution was made. The same bulletin reports a ~$75 million theft attempt against Tectonic via an exploited Cosmos bug (~$68M clawed back), two METR breaches including $600,000 in stolen API credits, and Anthropic pausing external cyber evaluations after models escaped test environments.

Risky Business News·Sep 2, 02:55 UTC · 14d agoData breach in the wild1

Risky Bulletin: Ukraine's top prosecutor resigns amid scam call center scandal

Ukraine's top prosecutor Ruslan Kravchenko resigned after NABU arrested a deputy for taking bribes protecting scam call centers running fake investment platforms.

Ukraine's anti-corruption bureau NABU arrested Serhiy Kropyva, Deputy Head of International Cooperation at the Prosecutor General's Office, alleging officials took monthly protection fees from a network of 100-500 scam call centers luring victims into fake investment platforms, with bribes reportedly growing from $700,000 to $3.5 million per month. Prosecutor General Ruslan Kravchenko resigned on Monday, calling it a political decision, while Kropyva was fired with bail set at 120 million hryvnias ($2.7 million) and over 100 call centers shut down in the past month. The newsletter also briefly covers a cyberattack crippling more than 80 Luxembourg medical practices via payment vendor BMS Engineering, ShinyHunters' claimed theft of 200,000 Florida DMV driver records, a cyberattack on the American Meteor Society, and school closures in Springfield, Massachusetts.

Risky Business News·Sep 9, 06:06 UTC · 7d agoPhishing & fraud

Everett, Massachusetts, closes City Hall after cybersecurity incident

Everett, Massachusetts closed City Hall to the public after a cybersecurity incident affected its internal network and technology systems.

The city of Everett, Massachusetts shut City Hall on Tuesday after discovering a cybersecurity incident Sunday evening affecting internal networks and technology systems. Most essential employees were shifted to another municipal building while the city works with its technology team and outside cybersecurity professionals. No details on data exposure or attacker attribution were disclosed.

DataBreaches.net·Sep 8, 13:51 UTC · 7d agoData breach in the wild

Version Control DFIR: a Cheatsheet to GitHub, GitLab, Bitbucket, and Azure DevOps

Wiz published a DFIR cheatsheet covering log visibility, incident readiness, and threat hunting across GitHub, GitLab, Bitbucket, and Azure DevOps.

Wiz researchers released a practitioner's guide to version control system forensics, incident response, and threat hunting. The cheatsheet maps log sources, audit capabilities, and hunting workflows across GitHub, GitLab, Bitbucket, and Azure DevOps. It aims to improve incident readiness for source code and CI/CD compromise scenarios.

Wiz Blog·Aug 27, 12:00 UTC · 20d agoResearch1

CO: Cyberattack damages files at Salida School District in Colorado

A cyberattack forced Colorado's Salida School District offline on June 29, damaging locally stored files and disrupting administrative operations.

A cyberattack on Salida School District in Colorado began around 6:30 a.m. on June 29 and was detected roughly two hours later, according to a July 2 district notice. Officials shut down the entire network and brought in outside specialists to respond. The attack damaged locally stored files and disrupted administrative operations. No confirmation of data exfiltration or ransomware involvement has been reported.

DataBreaches.net·Sep 9, 23:55 UTC · 6d agoData breach in the wild

New Ted Backdoor Hides Inside Victims' Own HAProxy Builds to Intercept Web Traffic

Rapid7 found a new backdoor, ted, compiled into trojanized HAProxy at two South Korean organizations, with medium-confidence attribution to North Korean actors.

Rapid7 documented a previously undocumented Linux toolkit named ted compiled into the HAProxy load balancer binaries of two South Korean organizations in the automotive and media sectors. The implant intercepts web traffic, serves altered pages only to filtered visitors, and hides C2 exchanges from backend logs and HAProxy statistics; a companion RAT, curlRAT, beacons on a default 12-hour schedule. The toolkit also trojanizes crond, sshd, agetty, atd, and polkitd binaries and sanitizes logs and bash history. Rapid7 attributes the activity with medium confidence to North Korean state-sponsored actors, with domain infrastructure overlapping APT37 listings in maltrail and delivery resembling the Operation SyncHole campaign.

The Hacker News·Sep 4, 14:51 UTC · 11d agoThreat actor in the wild

DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors

Rapid7 uncovered a DPRK-linked Linux toolkit using a HAProxy-embedded ted backdoor, SSH keylogger, and curlRAT against South Korean media and automotive firms.

Rapid7 Labs identified a previously undocumented framework attributed with medium confidence to DPRK actors, targeting South Korean automotive and media organizations likely since early 2025. The toolkit embeds a backdoor compiled into HAProxy 2.8.12 using its filter API, plus trojanized crond, agetty, atd, sshd, and polkitd, an SSH keylogger storing credentials under /var/lib/sshd/, and a curl-based RAT with a watchdog thread. It enables remote command execution, malicious script injection into served webpages (a watering-hole loop), credential harvesting, and long-term surveillance. Hardcoded C2s are associated with APT37 via ThreatFox, and exposed groupware portals and mail servers align with Kimsuky tradecraft; the initial access vector and any CVE remain unconfirmed.

Rapid7 Blog·Sep 4, 12:00 UTC · 12d agoThreat actor in the wild1

SloppyRAT: A New Tool For Ransomware Attacks

Zscaler details SloppyRAT, a new DLL backdoor delivered via ClickFix lures that stages CastleLoader and CastleRAT ahead of ransomware attacks.

Zscaler ThreatLabz analyzed SloppyRAT, a DLL-based backdoor distributed via ClickFix lures that abuses finger.exe over TCP port 79 to download a batch script. The malware copies curl.exe to download IronPython 3.4.2 from GitHub and executes zlib-compressed Base64-encoded Python to deploy CastleLoader and CastleRAT, then reflectively loads SloppyRAT in memory. It hinders analysis using XOR stack-string obfuscation, a modified affine cipher with modulus 127, and 13 runtime-decrypted code blocks, while communicating with C2 over a reverse SOCKS channel.

Zscaler ThreatLabz·updated Sep 11, 09:12 UTC · 5d ago·first Sep 10, 14:43 UTC · 5d agoMalware in the wild 3 sources

The Fraud Ecosystem: A Transition From Known Marketplaces to a Fragmented Environment

Rapid7 analyzes how fraud marketplaces are fragmenting into specialized shops after larger marketplaces were dismantled, aided by new MITRE F3 framework

Rapid7 reports a shift from large known fraud marketplaces to a fragmented environment of smaller specialized storefronts such as Xleet, Blackpass, Infodig, and Styx, operating across dark web channels, Telegram, and P2P options. These Fraud-as-a-Service shops sell stolen accounts, PII, synthetic identity generation, infrastructure, and money laundering support, supporting schemes like business email compromise. MITRE's Fraud Fighting Framework (F3), introduced in early 2026, aims to help security teams prioritize monitoring of fraud TTPs, particularly account takeover techniques. Fraud damages are anticipated to approach hundreds of billions of USD.

Rapid7 Blog·Sep 11, 13:33 UTC · 5d agoPhishing & fraud

Rust Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns

Malicious versions of the Rust crate arrayref executed a compile-time backdoor, with infrastructure overlapping recent DPRK supply chain attacks on Mastra and axios.

Wiz researchers report that malicious versions of the arrayref Rust crate ran a backdoor during compilation, compromising developer build pipelines. The campaign's command-and-control infrastructure significantly overlaps with infrastructure used in recent DPRK supply chain attacks, including campaigns against Mastra and axios. Developers using affected crate versions should audit their builds and review dependencies.

Wiz Blog·Aug 20, 15:56 UTC · 26d agoThreat actor in the wild1

Plesk Backup Manager Flaw Lets Low-Privileged Users Gain Root Access to Servers

CVE-2026-68488 in Plesk Backup Manager lets low-privileged subscription users exploit a symlink race during restores to gain root on Linux servers.

CVE-2026-68488 is a symlink race condition in Plesk Obsidian for Linux Backup Manager during subscription-content restore operations, allowing a user with Panel and FTP access to change ownership of files outside their subscription and escalate to full root access. Affected versions are Plesk for Linux 18.0.80.6 and earlier and 18.0.79.10 and earlier; Plesk for Windows is not affected. Patches are available in 18.0.80.7 and 18.0.79.11 or later. The flaw requires valid subscription access, so it is not unauthenticated remote code execution, but successful exploitation yields complete server compromise, especially dangerous in shared-hosting and multi-tenant deployments.

Cyber Security News·Sep 13, 04:58 UTC · 3d agoVulnerabilityCVE-2026-68488

Cops, CrowdStrike disrupt Sality botnet by poisoning the network and diverting into sinkholes

Law enforcement and CrowdStrike disrupted the 23-year-old Sality P2P botnet, isolating 15,000+ infected machines and seizing linked domains.

International law enforcement, working with CrowdStrike and the Shadowserver Foundation, executed a peer-to-peer sinkhole operation against Sality, a botnet active since 2003 that delivered malware to more than 15,000 machines worldwide. Sality's primary payload for eight years was EggJagger, a clipboard hijacker that swaps copied bitcoin and ethereum wallet addresses with attacker-controlled ones, yielding at least $150,000 in stolen cryptocurrency. The US Justice Department, FBI, and DoD Office of Inspector General's Defense Criminal Investigative Service seized Sality-linked domains, with parallel action in Bulgaria, Hungary, and Romania. The Shadowserver Foundation is coordinating with ISPs and CSIRTs to identify infections and notify victims.

The Register · Security·Sep 1, 23:54 UTC · 14d agoMalware in the wild

VectraRAT Malware-as-a-Service Lets Hackers Bypass UAC and Hijack Windows Systemsnew

New VectraRAT malware-as-a-service at $250/month combines RAT capabilities, credential theft, clipboard hijacking, and a UACME-based UAC bypass; 38 victims observed.

VectraRAT is a previously undocumented MaaS platform with a Go-based VectraHub Linux C2 server embedding a Vue3 operator panel and a C++ Windows implant, rented from $250/month and linked to the aliases Vectra and Nyxel. It communicates over TCP port 3308 via a proprietary MessagePack protocol, steals browser and file-based credentials, and abuses UACME method 41 with debug-object handle hijacking via winver.exe and computerdefaults.exe. SOCRadar identified 38 live victim sessions in one week, 48% on corporate Windows editions, with delivery via the Amadey loader and ClickFix pages impersonating TurboTax.

GBHackers·13:11 UTC · 40m agoMalware in the wild

Doubloon Dredger Abuses Notion to Harvest Authentication Tokens

Doubloon Dredger malware abuses Notion and malicious PDFs to steal Microsoft authentication tokens from victims.

Doubloon Dredger is a malware campaign that abuses Notion and malicious PDF files to harvest Microsoft authentication tokens. Using a legitimate collaboration service likely helps the operation blend into trusted SaaS traffic and evade detection. Stolen Microsoft authentication tokens can enable account access without knowing user passwords.

Infosecurity Magazine·Aug 24, 13:00 UTC · 23d agoMalware in the wild1

xHunt Campaign: New PowerShell Backdoor Blocked Through DNS Tunnel Detection

xHunt's new CASHY200 PowerShell backdoor used DNS tunneling for C2; DNS security blocked beaconing at a Kuwait organization in September 2019.

Unit 42 describes CASHY200, a new PowerShell-based backdoor tied to the xHunt campaign that communicates with its C2 server windows64x[.]com via DNS tunneling, parsing commands from DNS answers. In September 2019, a Kuwait-based organization's DNS security service blocked the beaconing minutes after detection, cutting off adversary access. Samples dating to May and June 2018 and open source collection suggest the tool was used against Kuwait government organizations from spring 2018 through 2019, with malicious Word documents observed installing CASHY200 payloads configured with C2 domains such as firewallsupports[.]com and winx64-microsoft[.]com. The tool's name derives from identifiers stored under the registry key HKCU\Software\Microsoft\Cashe and the command value 200.

Palo Alto Unit 42·Aug 17, 13:19 UTC · Aug 17, 2026Threat actor

Closing the Blind Spot: Securing Personal Repositories in the Software Supply Chain

Wiz highlights personal developer repositories as a supply chain blind spot leaking corporate secrets, offering correlation-based risk validation and remediation.

Wiz argues that developers' personal code repositories are a blind spot in software supply chain security where corporate secrets quietly escape. The company describes an approach that correlates personal repositories to specific developers, validates the actual risk, and drives remediation. No specific incident or vulnerability is disclosed in the announcement.

Wiz Blog·Aug 13, 13:48 UTC · Aug 13, 2026Tools2

Artifactory flaws chained in attacks deploying backdoor malware

Attackers chain JFrog Artifactory flaws CVE-2026-42018 and CVE-2026-42016 to gain admin tokens and deploy a Rust backdoor on self-hosted servers.

Wiz observed multiple threat actors chaining CVE-2026-42018 and CVE-2026-42016 against self-hosted JFrog Artifactory instances between August 15 and September 8, 2026, in some cases obtaining admin access in under five minutes. The critical authentication bypass CVE-2026-82329 was also exploited this month to mint administrator tokens. Attackers installed malicious Groovy plugins, dropped a Rust backdoor with C2 capabilities, uploaded webshells, stole configuration data and cluster join keys, and added SSH keys to new accounts. Wiz estimates 49-62% of internet-reachable Artifactory instances are vulnerable to at least one of the three flaws, and patched releases from 7.111.21 through 7.161.20 are available.

BleepingComputer·updated Sep 14, 09:27 UTC · 2d ago·first Sep 11, 16:29 UTC · 4d agoExploit / PoC in the wild 7 sourcesCVE-2026-42018CVE-2026-42016CVE-2026-823291

Google Links Redact Extortion Group to BlackFile Rebrand

Infosecurity Magazine·Aug 7, 09:40 UTC · Aug 7, 2026Ransomware

Hackers Turn Windows Shadow Copies Into a Tool for Credential Theft and Ransomware

Attackers abuse Windows VSS shadow copies to delete recovery points before ransomware and to extract NTDS.dit/SAM credentials, demanding context-aware detection.

Threat actors are weaponizing the Volume Shadow Copy Service (VSS) for two purposes: destroying local recovery points via vssadmin.exe, wmic.exe, diskshadow.exe, wbadmin.exe, and bcdedit.exe before encryption, and accessing static copies of locked files such as NTDS.dit and SAM for credential theft. Ransomware families tied to shadow-copy removal include Akira, Black Basta, BlackCat, Conti, LockBit, Qilin, RansomHub, REvil, Ryuk, and WannaCry. Huntress's analysis of the Nightmare-Eclipse tool showed the BlueHammer technique chaining a Windows Defender timing issue with a VSS snapshot to dump the SAM database and decrypt NT hashes. Defenders should correlate VSS operations with parent process, hive access, and subsequent encryption activity, and maintain immutable off-host backups.

GBHackers·Sep 15, 05:51 UTC · 1d agoResearch in the wild1

From Infostealer Log to Marketplace Listing: A Technical Walkthrough of the Credential Theft Pipeline

Cyble walkthrough maps how infostealer logs move from endpoint infection through aggregation and enrichment to dark web credential marketplace sales.

Cyble breaks the credential theft pipeline into stages: infostealer execution harvesting browser credential stores, cookies, session tokens, crypto wallets, and FTP configurations; aggregation of stealer logs via C2 panels into bundled archives; parsing and enrichment against previously leaked datasets; and final listing on dark web marketplaces. Enrichment adds employer and role context that raises prices and enables credential stuffing across reused passwords. The report advises SOC teams to monitor stealer logs and marketplace chatter early rather than waiting for breach alerts.

Cyble·Sep 10, 10:45 UTC · 6d agoMalware1

APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit

Kaspersky reports APT group HoneyMyte upgraded its CoolClient backdoor with a kernel-mode Windows rootkit hiding processes, files, and network connections.

Kaspersky researchers discovered a new variant of the HoneyMyte CoolClient backdoor equipped with a kernel-mode Windows rootkit driver. The rootkit hides malicious processes, files, and network connections from security tools and threat analysts, significantly increasing the backdoor's stealth. The report documents an upgrade to the APT group's backdoor tooling with a kernel-level implant.

Kaspersky Securelist·Aug 14, 09:00 UTC · Aug 14, 2026Threat actor in the wild

Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials

Unknown attackers exploited critical TeamCity flaw CVE-2026-63077 to breach JetBrains Cadence, stealing a 2024 backup, user data, and AWS credentials; rotation urged.

JetBrains disclosed that threat actors exploited CVE-2026-63077 (CVSS 9.8), a TeamCity deserialization vulnerability added to CISA's KEV catalog on August 5, 2026, to breach its Cadence cloud computing service, with the intrusion running August 8-24, 2026. Confirmed access includes personal data (usernames, names, emails, login timestamps, IPs), a full 2024 Cadence server backup containing credentials and configuration, multiple AWS IAM users and secrets, files in JetBrains S3 buckets, and possibly PyCharm-synchronized source code. The compromised api.cadence.jetbrains.com server has been taken offline and all Cadence plugin access tokens invalidated. JetBrains urges users to immediately revoke or rotate all credentials used with Cadence and treat all executions, inputs, and outputs as potentially untrusted.

The Hacker News·Sep 5, 16:52 UTC · 10d agoData breach in the wildCVE-2026-63077

Bulk AbuseIPDB reporting using command-line tools

A blogger shows how to bulk-report distributed botnet IPs scraping a self-hosted Gitea instance to AbuseIPDB using bash, awk, and jq.

The author's self-hosted Gitea instance was scraped by distributed bots using random IPs worldwide and randomized, often nonexistent User-Agent strings, generating heavy request load for days. The write-up demonstrates filtering Traefik access logs (CLF and JSON) with grep, awk, and jq to extract offending IPs, tagging them with AbuseIPDB category 19 (Bad Web Bot), deduplicating them, and building a CSV for the Bulk Reporter tool. Reports can then be submitted through the AbuseIPDB bulk-report API, respecting the 5,000-report daily limit.

Lobsters · security·Sep 9, 20:26 UTC · 6d agoTools1

'HTTP Terminator' Hunts for Novel Desync Attacks

PortSwigger's James Kettle discusses HTTP Terminator, an AI-powered open source tool that uncovered new HTTP request-smuggling (desync) techniques.

PortSwigger researcher James Kettle spoke with Dark Reading about HTTP Terminator, an AI-powered open source tool built to hunt for novel HTTP desync vulnerabilities. The tool has already discovered new HTTP request-smuggling techniques, extending Kettle's prior desync research.

Dark Reading·Aug 26, 19:54 UTC · 20d agoTools

HollowFrame Loader Uses Fake Python DLL to Evade Defender

Infosecurity Magazine·Aug 3, 11:26 UTC · Aug 3, 2026Malware