60
60
Automatically Detecting DNS Hijacking in Passive DNS
Unit 42's machine learning pipeline detected 6,729 DNS hijacking events between March and September 2024, hitting political parties, ISPs, and universities.
Unit 42 processes roughly 167 million new DNS records daily and applies a machine learning model using 74 features over 169 TB of passive DNS and geolocation data to flag hijacked domains. From March to September 2024 the pipeline screened over 29 billion records and classified 6,729 as DNS hijacking, averaging 38 detections per day; a new model detects hijacks in customer traffic within about 10 minutes. Notable cases include a Hungarian political party's hijacked domain, defacement of a large utility company and ISP, and university and research center domains repurposed for illicit gambling. DNS hijacking typically relies on stolen registrar or DNS provider credentials or cache poisoning, enabling MitM attacks, phishing, drive-by downloads, and scams.
45
60
Microsoft's January 2024 Windows Update Patches 48 New Vulnerabilities
60
60
60
60
60
SloppyRAT: A New Tool For Ransomware Attacks
Zscaler details SloppyRAT, a new DLL backdoor delivered via ClickFix lures that stages CastleLoader and CastleRAT ahead of ransomware attacks.
Zscaler ThreatLabz analyzed SloppyRAT, a DLL-based backdoor distributed via ClickFix lures that abuses finger.exe over TCP port 79 to download a batch script. The malware copies curl.exe to download IronPython 3.4.2 from GitHub and executes zlib-compressed Base64-encoded Python to deploy CastleLoader and CastleRAT, then reflectively loads SloppyRAT in memory. It hinders analysis using XOR stack-string obfuscation, a modified affine cipher with modulus 127, and 13 runtime-decrypted code blocks, while communicating with C2 over a reverse SOCKS channel.
48
Containers on fire: from container escapes to supply chain attacks
60
Microsoft May 2026 Patch Tuesday: Many fixes, but no zero-days
60
Windows NTLM vulnerability exploited in multiple attack campaigns (CVE-2025-24054)
60
60
60
60
Critical Flaw in Ivanti Virtual Traffic Manager Could Allow Rogue Admin Access
60
CISA adds Google Chromium V8 Type Confusion bug to its Known Exploited Vulnerabilities catalog
60
60
Microsoft fixes critical flaws in Windows Kerberos, Hyper-V (CVE-2024-20674, CVE-2024-20700)
60
Apple fixes 3 zero-day vulnerabilities exploited to compromise iPhones
60
CISA Warned About Critical Vulnerabilities in Illumina's DNA Sequencing Devices
60
60
Vulnerability Spotlight: WiFi-connected security camera could be manipulated to spy on communications, among other malicious actions
60
New Apache Log4j Update Released to Patch Newly Discovered Vulnerability
60
60
60
Update Microsoft Windows Systems to Patch 99 New Security Flaws
60
60
Latest Microsoft Updates Patch 4 Critical Flaws In Windows RDP Client
60
60
60
60
57
60
60
60
60