ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “driver”

667 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 262Exploit / PoC 190Ransomware 69Data breach 55Malware 40Threat actor 22Advisory 12Phishing & fraud 11Policy & legal 6AI safety & security 3Research 1Industry 1Tools 1
SeverityAllcritical 531high 114medium 25low 1info 2

FBI Probes Service Selling 153M+ Drivers Licenses

Dark web service Nexus sells scans of 153M+ US and Canadian drivers licenses, apparently siphoned from a breached identity verification company; FBI opened an inquiry.

A new dark web identity theft service called Nexus, advertised on the Exploit forum, offers scans of more than 153 million drivers licenses from the US and Canada, plus over 10 million ID cards and millions of travel and medical documents. The data appears to come from an ongoing breach at a major Louisiana-based identity verification company, with records growing by roughly 400,000 in 24 hours. Records include high-ranking US officials such as Defense Secretary Pete Hegseth, and timestamps suggest data was captured during car rentals and travel. The FBI's New Orleans field office has launched an official inquiry into the source of the images.

Krebs on Security · 14d agoData breach in the wild1

Mustang Panda Upgrades CoolClient With a Kernel Rootkit

Mustang Panda's updated CoolClient backdoor deploys a signed kernel driver to hide processes, files and network activity in Asian intrusions.

Kaspersky analysis shows Mustang Panda (HoneyMyte) upgraded its CoolClient espionage backdoor with a signed kernel-mode driver installed as a Windows service, communicating via IOCTL requests to hide processes, files and registry entries. In a Myanmar campaign the actor deployed PlugX first, then CoolClient via a fake Windows Defender directory and Sangfor defender.exe DLL sideloading, with scheduled task and AutoRun persistence and UAC bypass. The updated variant was observed in intrusions across Pakistan, Mongolia and Myanmar, with victims also in Russia including confirmed government entities.

Security Affairs · Aug 16, 2026Threat actor in the wild1

Microsoft’s September 2026 Patch Tuesday addresses 964 CVEs (CVE-2026-81963, CVE-2026-85880)

Microsoft's September 2026 Patch Tuesday fixes a record 964 CVEs, including two zero-days actively exploited in the wild.

Microsoft patched a record 964 CVEs in its September 2026 Patch Tuesday release, with 101 rated critical and 824 rated important, making it the largest Patch Tuesday to date. The release includes fixes for two zero-days that were exploited in the wild, with CVE-2026-81963 and CVE-2026-85880 highlighted in the release. Affected products span Windows core components, Office, Exchange, .NET, Visual Studio, Active Directory services (including AD CS and AD FS) and numerous Azure services. Tenable notes the release surpasses July's as the biggest ever.

Tenable Blog · 7d agoVulnerability in the wildCVE-2026-81963CVE-2026-858801

IDScan Confirms Data Breach Following 153 Million Driver’s Licenses Leaked on the Dark Web

IDScan.net confirms a breach after a marketplace advertised over 153 million US and Canadian driver's licenses, possibly exfiltrated continuously for over a year.

The Louisiana identity-verification firm detected unauthorized access on or around September 1, 2026, after the 'Nexus' identity theft service on the Exploit forum began advertising 170M+ people's records, including 153M+ driver's licenses, 10M+ ID cards, 3M+ travel documents, and 579,000 medical cards. Canadian records exceed 1.1 million, and the trove includes commercial licenses, Common Access Cards, and dispensary IDs, with a record for US Defense Secretary Pete Hegseth reportedly included. Nexus operators claim continuous exfiltration for over a year, with the license count growing by nearly 400,000 in 24 hours, suggesting the intrusion may be active. The FBI's New Orleans field office has opened a formal inquiry, and IDScan.net is offering free credit monitoring.

Cyber Security News · 5d agoData breach in the wild 4 sources

ClearFake Deploys Crypto Stealer That Uses Vulnerable Driver to Kill EDR Security Tools

Cisco Talos details ClearFake's fake-CAPTCHA chain deploying ZigCryptoStealer with a BYOVD attack that kills EDR processes, observed at a Ukrainian government organization in April 2026.

ClearFake compromises websites, injects JavaScript via a malicious Cloudflare Worker, retrieves instructions from BNB Smart Chain contracts (EtherHiding), and presents a fake Google CAPTCHA that tricks Windows users into pasting a command that loads a remote library over WebDAV via rundll32. The crypto-stealer branch uses DLL side-loading with a signed Chrome component to launch ZigCryptoStealer, which hijacks clipboard cryptocurrency addresses, alongside a signed but vulnerable Windows driver used in a BYOVD attack to terminate EDR processes. A parallel branch delivers Amatera secondary payloads that install a hidden remote-access client providing operator desktop control, with Cisco Talos tracking the remote-loader activity as UAT-10820. Talos observed unusual remote library execution at a Ukrainian government organization in April 2026 and assesses the attacks are part of a broader theft operation rather than a single targeted campaign.

Cyber Security Newsupdated · 4d agofirst · 6d agoMalware in the wild 4 sources1

Mustang Panda Adds Signed Windows Rootkit to CoolClient Backdoor for Stealth

Kaspersky reports Mustang Panda's updated CoolClient backdoor now deploys a signed kernel-mode Windows rootkit, hitting government victims in Myanmar, Mongolia, Pakistan, and Russia.

Kaspersky identified a new CoolClient variant attributed to HoneyMyte (Mustang Panda) that installs a digitally signed Windows kernel driver, msagent.sys, to hide and protect malicious processes, files, registry keys, and C2 network information. CoolClient is consistently deployed as a secondary backdoor after PlugX, with confirmed victims including government entities in Myanmar, Mongolia, Pakistan, and Russia. In a Myanmar campaign, PlugX was used to deploy CoolClient via a renamed Sangfor executable for DLL side-loading, a scheduled task for persistence, and RPC-based process creation with PPID spoofing. The driver, signed with a 2013 certificate issued to Nanjing Ranyi Technology, implements 33 IOCTL handlers, process hiding via unlinking, a filesystem minifilter, and registry callbacks.

The Hacker News · Aug 15, 2026Threat actor in the wild1

Microsoft September 2026 Patch Tuesday Fixes 973 Vulnerabilities and 2 Exploited Zero-Days

Microsoft's September 2026 Patch Tuesday fixes 973 vulnerabilities, including two zero-days already exploited in the wild.

Microsoft's September 2026 Patch Tuesday addresses 973 vulnerabilities across Windows, Office, and Azure components, including two zero-days already exploited in the wild. CVE-2026-81963, an elevation of privilege flaw in the Windows Update Stack, is flagged as an exploited zero-day. The release includes numerous remote code execution and information disclosure fixes for Microsoft Excel and Word, plus patches for the Windows kernel, ALPC, Print Spooler, ReFS, Entra ID, and Azure CLI.

GBHackers · 7d agoAdvisory in the wildCVE-2026-85880CVE-2026-85877CVE-2026-85875+27 CVEs

Silver Fox Targets Japanese Manufacturer with 3

Chinese group Silver Fox used new vulnerable drivers and DLL side-loading to deploy ValleyRAT at a Japanese industrial manufacturer.

Cato Networks detailed a Silver Fox campaign against a Japanese industrial manufacturing organization combining new vulnerable-driver abuse (BootRepair.sys and EnPortv.sys alongside wsftprm.sys), DLL side-loading via Zeon Corporation PDF binaries, and NTDLL unhooking to deliver ValleyRAT (Winos 4.0), a Gh0st RAT variant. The chain starts with an invoice-themed phishing lure hosting attacker-controlled content on legitimate QQ and Tencent Cloud services. Shellcode is injected into svchost.exe via thread-context hijacking, and a dual watchdog design pairs payload monitoring with a scheduled-task batch script for persistence. A separate 180-day VirusTotal retrohunt found 146 Atlas RAT samples across six PDB builds, though the Silver Fox link remains circumstantial.

The Hacker News · 20d agoThreat actor in the wild

IDScan confirms breach after hackers offer 153 million driver’s license scans for sale

IDScan confirmed hackers accessed customer data in its cloud after scans of roughly 153 million driver's licenses surfaced for sale on a dark web marketplace.

IDScan.net published a breach notice on September 4, after learning around September 1 that an unauthorized third party may have accessed or copied customer information in its cloud platform, potentially including full names and government-issued ID numbers. KrebsOnSecurity tied the incident to Nexus, a Russia-linked dark web marketplace selling access to over 153 million US and Canadian driver's license scans, plus 10 million ID cards, more than 3 million travel documents, and at least 579,000 medical cards. The company did not disclose how many customers were affected, is offering free credit monitoring, faces multiple lawsuits, and the FBI has opened an inquiry. IDScan's government ID authentication is widely used by banks, cannabis retailers, and gun stores.

The Record · 5d agoData breach in the wild

ShinyHunters claims Florida DMV breach, puts data on the clock

ShinyHunters claims it breached Florida DMV's DAVID database, stole 200,000+ driver records including SSNs, and set a September 11 extortion deadline.

The ShinyHunters extortion group claims it breached the Florida Department of Highway Safety and Motor Vehicles' DAVID driver and vehicle database and stole more than 200,000 records. As evidence it published a screenshot of a Jeffrey Epstein record showing address, Social Security number, date of birth, license number and registered vehicles, and set a September 11 deadline before publication. The group says it obtained access through a password-reset weakness, compromised employee accounts, and queried and downloaded driver records and images. The Florida DMV has not confirmed the claim; it follows a separate confirmed IDScan.net breach exposing over 153 million license scans that prompted an FBI investigation.

CSO Online · 7d agoData breach in the wild1

The September 2026 Security Update Review

ZDI's September 2026 Microsoft update review lists two already-exploited Windows EoP zero-days and dozens of critical RCEs across Office, SQL Server, and Windows services.

The review catalogs Microsoft's September 2026 fixes, marking CVE-2026-85880 (Windows ALPC) and CVE-2026-81963 (Windows Update Stack) as already exploited elevation-of-privilege issues. It also lists critical RCE flaws in Office, Word, Excel, PowerPoint, Outlook, SQL Server, Windows DNS, DHCP and Failover Cluster, plus graphics component RCEs. Azure-side fixes include Entra ID, Copilot Studio, Azure AI Language and Azure AD B2C elevation-of-privilege flaws.

Zero Day Initiative Blog · 7d agoAdvisory in the wildCVE-2026-85880CVE-2026-81963CVE-2026-70352+27 CVEs1

Spark RAT Targets Cambodia, Abuses Vulnerable OPSWAT Driver to Disable Security Tools

Acronis details a Spark RAT campaign against Cambodia abusing the vulnerable OPSWAT ardrv.sys driver (CVE-2026-36425) to disable Microsoft Defender and other security tools.

Acronis TRU analyzed a multi-stage Spark RAT campaign targeting Cambodian individuals and organizations with lures spanning government notices, public health materials, and real estate documents. Attack chains use phishing emails with Inno Setup archives, DLL side-loading via a signed Tencent executable, and BYOVD abuse of the vulnerable OPSWAT ardrv.sys driver (CVE-2026-36425) to terminate security software. Shellcode hidden in PNG files patches AMSI and ETW, establishes scheduled task and service persistence, and injects into vssvc.exe and ctfmon.exe to run the open-source Go-based Spark RAT. Tactics resemble the Silver Fox actor, but Acronis tracks the cluster as unattributed with low confidence.

The Hacker News · 19d agoMalware in the wildCVE-2026-36425

Microsoft Patch Tuesday, September 2026 Security Update Review

Microsoft's September 2026 Patch Tuesday fixes 974 vulnerabilities, including 113 critical and two actively exploited Windows privilege escalation flaws.

Microsoft's September 2026 Patch Tuesday fixes 974 vulnerabilities, its largest release ever, including 113 critical and 860 important, covering Windows HTTP.sys, Hyper-V, Entra ID, Exchange Server, Office, DNS, and more. Two zero-days are confirmed exploited in the wild: CVE-2026-81963 (Windows Update Stack EoP) and CVE-2026-85880 (ALPC heap overflow), both letting authenticated attackers gain SYSTEM privileges. Notable criticals include an Entra ID authentication bypass (CVE-2026-62916) and multiple Windows DNS Server and Office remote code execution flaws.

Qualys ThreatPROTECT · 7d agoVulnerability in the wildCVE-2026-81963CVE-2026-85880CVE-2026-58599+27 CVEs

FBI Probes Possible Breach of 153 Million Driver’s Licenses

FBI investigates possible breach exposing up to 170M North American driver's licenses, data sold on Exploit forum via 'Nexus' service, linked to IDScan.net.

The FBI is investigating a potentially massive breach of identity data affecting as many as 170 million North Americans, first reported by Krebs. The 'Nexus' service on the Exploit cybercrime forum claimed to hold over 153 million US and Canadian driver's licenses plus ID cards, travel documents, and medical cards, sourced from an active breach at a major identity verification company. Krebs linked the trove to New Orleans-based IDScan.net, which is investigating. The service went dark shortly after publication; experts warn stolen license data (DOB, address, ID numbers) can't be changed and could enable lifelong identity fraud.

Infosecurity Magazine · 13d agoData breach in the wild

Srsly Risky Biz: America's Drivers Licence Breach is a National Security Disaster

Dark web service Nexus sold 153 million US and Canadian driver's licenses, linked to identity verification firm IDScan under FBI investigation.

Krebs On Security reported that a dark web service called Nexus sold access to 153 million US and Canadian driver's licenses, claiming over a year of continuous exfiltration from a major identity verification company, with roughly 400,000 new licences added in a single day. Krebs verified the data as genuine and linked the incident via circumstantial evidence to identity verification firm IDScan, whose licences of senior US officials including Secretary of War Pete Hegseth appeared in the database; the FBI is investigating and IDScan has confirmed a breach inquiry. The article argues the data has national security implications, citing how Chinese APT espionage (Anthem, Equifax, Marriott, OPM) and Bellingcat investigations exploited leaked databases. Class action suits are being prepared, and the piece calls for stricter oversight of identity verification firms.

Risky Business News · 6d agoData breach in the wild

Microsoft Patches 398 Flaws Including a Windows Driver Zero

Microsoft's August Patch Tuesday fixes 398 CVEs, including actively exploited Windows zero-day CVE-2026-68820 used by Lazarus for SYSTEM privilege escalation.

Microsoft's August 2026 Patch Tuesday release addresses 398 new vulnerabilities, 62 rated Critical by the Zero Day Initiative, with CVE-2026-68820 (CVSS 7.0), a use-after-free in the afd.sys Windows kernel driver, the only flaw flagged as actively exploited. Check Point Research attributed exploitation of the privilege escalation bug to Lazarus' Operation Dream Job campaign. Four unauthenticated remote code execution flaws rated 9.8 affect Windows DNS Server (CVE-2026-62878, called wormable by ZDI), Windows Deployment Services (CVE-2026-62893), Microsoft QUIC (CVE-2026-62815) and HPC Pack (CVE-2026-59124). The release also completes a two-part SharePoint fix with RCE component CVE-2026-63520, following July's authentication bypass fix CVE-2026-55040.

The Hacker News · Aug 11, 2026Exploit / PoC in the wildCVE-2026-68820CVE-2026-62878CVE-2026-62893+4 CVEs

Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days

Microsoft's September 2026 Patch Tuesday fixes a record 966 flaws, including two Windows zero-days actively exploited to gain SYSTEM privileges.

Microsoft's September 2026 Patch Tuesday addresses a record 966 vulnerabilities, including 105 rated Critical, 81 of them remote code execution bugs. Two zero-days were actively exploited: a Windows Update Stack link-following flaw and a Windows ALPC heap-based buffer overflow, both allowing local elevation to SYSTEM privileges. The ALPC flaw was reported by Volexity and Proofpoint researchers, while the Update Stack flaw was credited to Romain Deperne and the Microsoft Threat Intelligence Centre. Microsoft shared no details on how the flaws were exploited in attacks.

BleepingComputer · 7d agoAdvisory in the wildCVE-2026-69805CVE-2026-58649CVE-2026-69806+27 CVEs1