ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “IDS Ukraine”

117 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllMalware 74Ransomware 58Threat actor 28Vulnerability 23Data breach 23Phishing & fraud 17Policy & legal 8Exploit / PoC 8Advisory 3Industry 1Research 1AI safety & security 1
SeverityAllcritical 62high 117medium 48low 17info 1

Risky Bulletin: Slovakia finds Russian backdoor in traffic speed cameras

Slovakia's NBU found an SMS-triggered backdoor in Russian-made NERO R-ONE traffic cameras, pausing a 279-unit deployment.

Slovakia's national security service NBU issued an alert against NERO R-ONE high-speed traffic cameras after finding a backdoor that grants shell and network access via SMS from hardcoded Russian phone numbers. The cameras are a rebranded version of the Russian CORDON PRO.M model by St. Petersburg firm Semicon, purchased via a Cyprus shell company under a €30 million EU-funded project. The report also found SecureBoot disabled, vulnerable web management, and unauthenticated live streams; the Interior Ministry paused deployment of 279 cameras pending independent assessment.

Risky Business News · 28d agoThreat actor in the wild1

ThreatsDay: CEO Phishing Kits, 5K Dropbox Account Hacks, OAuth Traps + 17 More Stories

Microsoft warns of Teams IT-impersonation intrusions deploying Node.js implants; Spring Ring vishing hit 150+ employees across 10 companies; The Gentlemen ransomware claims 683 victims.

Microsoft warned of a human-operated campaign abusing Teams external collaboration to impersonate IT help desk staff, deploy malicious MSI packages staging Node.js runtimes and obfuscated JavaScript implants, then pivot to domain controllers over WinRM. Unit 42 documented the Spring Ring vishing operation targeting over 150 employees across at least 10 companies using 26 attacker identities, including an NTLM relay variant against domain controllers. Sophos reported The Gentlemen ransomware (Gold Sherwood) reached 683 total victims by end of July 2026, adding 169 in July, with a playbook using BYOVD-based EDR killers and backup tampering. Group-IB found the Outsider phishing-as-a-service platform created 700+ new phishing pages within a month despite law enforcement takedowns.

The Hacker News · 12d agoThreat actor in the wild1

Apple Warns Users in 110 Countries They May Be Targets of Mercenary Spyware

Apple sent mercenary spyware threat notifications to users in 110 countries, including Ukrainian military members, in what researchers call an unprecedented notification wave.

Apple notified an unspecified number of users in 110 countries that they may have been targeted by mercenary spyware attacks, bringing total notifications to over 150 countries since the program began in late 2021. Apple does not attribute the attacks but describes the alerts as high-confidence indicators of individual targeting against journalists, activists, politicians, and diplomats. Citizen Lab's John Scott-Railton called the geographic scale unprecedented, and Access Now reported a record number of help requests, with recipients including members of Ukraine's military. Apple advised users to update devices, enable 2FA and Lockdown Mode, and use Stolen Device Protection.

The Hacker News · 29d agoThreat actor in the wild

Large DDoS attack knocks Norwegian public services offline

A large DDoS attack on Norwegian IT partner Vivicta disrupted 10 government services, including ID-porten used by over 4.5 million users, for 30+ hours.

Norway's Digitalisation Agency (Digdir) said a distributed denial-of-service attack that began Monday targeted the infrastructure of its IT partner Vivicta and lasted around 30 hours at varying intensity, with some services still affected Tuesday. Disrupted services included ID-porten, a national digital identity gateway used by more than 4.5 million people, which many government services and parts of the health sector, such as online pharmacies and the electronic prescription system, rely on for authentication. Digdir said attackers did not gain access to sensitive information, and it was the third DDoS incident since June, reportedly two to three times larger than the previous one. Attribution and possible links between the incidents remain unclear.

The Record · 22d agoThreat actor

Threat Brief: Ongoing Russia and Ukraine Cyber Activity

Ukrainian government sites were defaced via OctoberCMS CVE-2021-32648 while Microsoft-attributed actor DEV-0586 deployed destructive WhisperGate malware.

Unit 42 tracks January 2022 attacks against Ukrainian government websites that were defaced or made inaccessible, which Ukraine attributed to Russia. Attackers exploited CVE-2021-32648, an account takeover flaw in OctoberCMS prior to 1.0.472, by submitting a boolean true as the password reset code to bypass validation. Separately, WhisperGate malware, attributed by Microsoft to DEV-0586, disabled Windows Defender and corrupted files across multiple Ukrainian organizations, using a ransomware-appearing first stage and an HTTPS-beaconing second stage with LOLBINs and anti-analysis techniques.

Palo Alto Unit 42 · Aug 17, 2026Threat actor in the wildCVE-2021-326481