Flux 443

Dutch investigators have seized more than 800 servers linked to Russian bulletproof hosting provider THE.Hosting, but researchers say the takedown left much of the operation’s core IP space untouched and still actively scanning networks across the European Union. In an analysis of the infrastructure published after the raid, researchers at Ellio reported that Dutch authorities confiscated…

A previously unknown threat actor dubbed GreyVibe is using generative AI tools to accelerate cyber operations against Ukraine and organizations linked to its war effort, according to new research from WithSecure[ The group is assessed as Russia-linked and appears to be conducting long-running, intelligence-driven campaigns that fold into Moscow’s wider hybrid warfare strategy against…

A wave of employee-built, AI-generated applications is quietly expanding the enterprise attack surface, with one recent “Shadow Builders” report claiming more than 2,000 exposed AI-built apps discovered on the public internet across customer environments. Framed as a new era of “shadow AI,” the findings highlight how workers are now using coding copilots and agents to assemble full production…

India’s Computer Emergency Response Team (CERT-In) is pushing organizations to dramatically accelerate patch cycles, issuing new guidance that calls for critical vulnerabilities in internet-facing systems to be fixed within 12 hours of being flagged “where feasible” in light of rapidly evolving, AI-assisted exploitation. The advisory raises the bar for vulnerability management across Indian…

An Iran-linked cyber-espionage group tracked as Screening Serpens, also known as UNC1549, Nimbus Manticore and Smoke Sandstorm, is deploying newly identified remote access Trojans (RATs) in highly tailored spear-phishing operations against high-value targets in the U.S., Israel, the United Arab Emirates and other Middle Eastern countries, according to research from Palo Alto Networks’ Unit 42…

A newly disclosed Drupal Core SQL injection vulnerability is now being actively exploited against internet-facing sites, prompting urgent patching guidance from Drupal, national CERTs, and security researchers. The bug, tracked as CVE-2026-9082, affects Drupal installations using PostgreSQL and could allow unauthenticated attackers to steal or tamper with data and, in some cases, achieve remote…

The SANS Institute is pushing deeper into offensive security training with its SEC670 course, “Red Teaming Tools – Developing Windows Implants, Shellcode, Command and Control,” giving experienced practitioners hands-on practice in building stealthy Windows malware. The class focuses on writing custom implants and evasive payloads rather than reverse-engineering them, a perspective that mirrors…

European authorities have dismantled First VPN, a long-running virtual private network service allegedly tailored to cybercriminals and used by ransomware crews and fraudsters to mask their operations, in a cross-border takedown that seized dozens of servers and key domains. The coordinated action, codenamed Operation Saffron, was led by France and the Netherlands with support from Europol and…

Lawmakers on Capitol Hill are demanding answers from the U.S. Cybersecurity and Infrastructure Security Agency (CISA) after a contractor allegedly published AWS GovCloud keys and a trove of internal credentials to a public GitHub repository, forcing the agency into an ongoing scramble to contain the fallout. The exposure, first detailed by KrebsOnSecurity, has raised uncomfortable questions about…

U.S. and Canadian authorities have arrested a 23-year-old Ottawa man accused of running KimWolf, a massive distributed denial-of-service botnet-for-hire that hijacked more than a million internet-connected devices worldwide. A criminal complaint unsealed in the District of Alaska charges Jacob Butler, also known online as “Dort,” with aiding and abetting computer intrusion in connection with the…

A newly analyzed multi-stage malware is targeting a wide range of Chromium-based browsers to steal credentials, exfiltrate sensitive documents, and maintain remote shell access, according to a recent Stormcast podcast and accompanying SANS Internet Storm Center diary. The sample, examined by SANS ISC handlers, is built around three distinct modules. The first component is a browser credential…

Canadian authorities have arrested a 23-year-old Ottawa resident accused of helping run the Kimwolf Internet-of-Things (IoT) botnet, a sprawling network of hijacked devices that fueled record-breaking distributed denial-of-service (DDoS) attacks and harassed security researchers. According to charging documents described in court and in reporting by KrebsOnSecurity, Jacob Butler, allegedly known…

GitHub has confirmed that a recent security incident involving unauthorized access to its internal repositories stemmed from the compromise of an employee device through a poisoned Visual Studio Code extension, an intrusion that ultimately exposed code from roughly 3,800 internal projects. The company said the breach was confined to GitHub-internal repositories and that it has found no evidence…

GitHub is investigating a reported breach of its internal infrastructure after the threat actor known as TeamPCP claimed on an underground forum to be selling source code and data from roughly 4,000 of the company’s private repositories. In an initial statement, the Microsoft-owned platform said it is probing unauthorized access to internal repos but currently has no evidence that customer…

A phishing-as-a-service operation dubbed “EvilTokens” is using Microsoft’s legitimate OAuth device code flow to hijack accounts, underscoring how attackers can bypass multi-factor authentication (MFA) by harvesting consent tokens instead of passwords. According to researchers cited by The Hacker News, the service went live in February 2026 and, within weeks, was linked to compromises at more than…

A new macOS info-stealer dubbed SHub Reaper is being distributed through trojanized installers for popular apps including WeChat and Miro, using AppleScript-based execution and spoofed Google, Microsoft and Apple login prompts to steal credentials and backdoor compromised systems, according to analysis shared with this publication. The campaign relies on users downloading fake installers that…

Unconfirmed claims of three new Windows zero-day vulnerabilities, nicknamed YellowKey, GreenPlasma and MiniPlasma, are circulating in the wake of Microsoft’s latest Patch Tuesday releases, adding to a sense of continuous pressure on defenders even as vendors race to close actively exploited holes. The codenames come from a security researcher who has been drip-feeding reports of alleged new…