-
The U.S. Federal Bureau of Investigation (FBI) has warned that cybercriminals are impersonating financial institutions with an aim to steal money or sensitive information to facilitate account takeover (ATO) fraud schemes. The activity targets individuals, businesses, and organizations of varied sizes and across sectors, the agency said, adding the fraudulent schemes have led to more than $262
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Modern cybersecurity faces an escalating challenge: fileless malware and obfuscation techniques increasingly bypass traditional file-based detection methods.
To address this growing threat, JPCERT/CC has released YAMAGoya. This open-source threat hunting tool leverages industry-standard detection rules to identify suspicious activity in real time.
YAMAGoya represents a significant advancement in endpoint threat detection by combining Event Tracing for Windows (ETW) event monitoring with memory scanning capabilities.
Open-Source Endpoint Detection Solution
Unlike conventional security tools that rely on proprietary detection engines, YAMAGoya directly supports Sigma and YARA rules.
Enabling security analysts to deploy community-driven detection logic across their infrastructure.
The tool operates entirely in userland, requiring no kernel driver installation, which simplifies deployment across organizational environments.
Its real-time monitoring capabilities track files, processes, registry modifications, DNS queries, network connections, PowerShell execution, and WMI commands simultaneously.

YAMAGoya startup screen This comprehensive approach enables the detection of both traditional and fileless malware threats.
According to JPCERT/CC, YAMAGoya supports multiple rule formats, including Sigma rules, YARA rules for memory scanning, and custom YAML rules for correlation-based detection.
JPCERT/CC security teams can create sophisticated detection logic that correlates multiple events.
Such as file creation followed by process execution, DLL loading, and network communication, to identify malicious activity patterns.
The tool is available for immediate evaluation through pre-built binaries on GitHub, with source code available for organizations requiring custom builds.
YAMAGoya operates via both graphical and command-line interfaces, accommodating different operational preferences.

YAMAGoya’s Alert tab Users can run Sigma rule monitoring or memory scanning with simple commands, provided they have administrative privileges.
JPCERT/CC detection alerts appear in the tool’s interface. They are logged to Windows Event Log with specific event IDs for integration with security information and event management (SIEM) systems.
This enables centralized monitoring and alerting across enterprise environments. By supporting industry-standard detection rules, YAMAGoya democratizes advanced threat detection capabilities.
JPCERT/CC researchers and incident responders can now leverage community-developed Sigma and YARA rules without vendor lock-in, strengthening the collective cybersecurity defense posture against emerging threats.
Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.
The post YAMAGoya – Real-Time Threat Monitoring Tool Using Sigma and YARA Rules appeared first on Cyber Security News.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
New release brings significant improvements to the penetration testing framework, introducing enhanced GUI features, REST API support, and powerful new evasion techniques that security researchers can leverage for offensive operations.
The latest release features a completely redesigned graphical interface with multiple theme options, including Dracula, Solarized, and Monokai.
All visualizations have been updated, including an improved Pivot Graph that now displays listener names and transition types for better infrastructure management.
Category Feature GUI & Interface Modern redesigned client with Dracula, Solarized, Monokai themes Updated Pivot Graph with listener names and pivot types Java 17 minimum requirement REST API Script with any programming language (Beta) Advanced automation and custom client development ML/LLM integration support Custom C2 User Defined Command and Control (UDC2) Custom C2 channels via BOFs ICMP and unconventional channel routing Process Injection RtlCloneUserProcess (DirtyVanity-based) TpDirect (thread pool manipulation) TpStartRoutineStub (thread pool triggering) EarlyCascade (fork/run injection) UAC Bypasses uac-rpc-dom (AppInfo ALPC bypass) uac-cmlua (ICMLuaUtil COM interface) Windows 10–11 24H2 compatible Memory Operations BeaconDownload API (up to 2GB in-memory) Drip loading for EDR evasion No disk writes for sensitive data Beacon Improvements Sleepmask for pivot beacons IPv6 SOCKS5 proxy support Fixed SSH Beacon (Mac/Linux) Task ID logging for operations A significant change requires users to upgrade to Java 17 or newer. Earlier Java versions will no longer run the application, ensuring access to modern security features and improved performance.
Revolutionary REST API and Custom C2 Channels
For the first time, Cobalt Strike users can script the framework using any programming language through a new REST API (currently in beta).
This enables advanced automation, server-side operation storage, and the development of custom Cobalt Strike clients.
The REST API opens the door to integrating machine learning models into offensive workflows, in line with emerging research by security teams exploring AI-powered exploitation techniques.

The high-level architecture of UDC2 Additionally, User Defined Command and Control (UDC2) allows operators to develop custom C2 channels as Beacon Object Files (BOFs).
This eliminates previous limitations by enabling traffic to be routed through unconventional channels, such as ICMP, while maintaining compatibility with custom transformations and obfuscation methods.
Enhanced Process Injection and UAC Bypasses
Cobalt Strike 4.12 introduces four new process injection techniques designed to evade endpoint detection and response (EDR) systems.
These include RtlCloneUserProcess (based on DirtyVanity research), TpDirect, TpStartRoutineStub, and EarlyCascade, all implemented as BOFs for flexibility.
Two new UAC bypass methods, uac-rpc-dom and uac-cmlua, work across Windows 10 through Windows 11 24H2, providing reliable privilege escalation paths for tested environments.

A screenshot of the new Process Injection GUI with a custom technique The BeaconDownload API now supports downloading in-memory buffers up to 2GB without writing files to disk, reducing analytical indicators.
Drip-loading functionality has been added to break event correlation by spreading payload writes with delays, thereby defeating detection logic based on injection-primitive sequences.

A screenshot showing the new UDRL-VS GUI Pivot Beacons now support the Sleepmask evasion technology, and IPv6 support has been added for SOCKS5 proxying, expanding operational flexibility.
These updates position Cobalt Strike 4.12 as a comprehensive framework for modern red team operations and security research.
Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.
The post Cobalt Strike 4.12 Released With New Process Injection, UAC Bypasses and Malleable C2 Options appeared first on Cyber Security News.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A significant issue has been disclosed that affects multiple versions of the identity and access management platform.
The flaw stems from a hardcoded default encryption key used for password storage, allowing attackers with database access to recover plaintext passwords.
The vulnerability impacts Apache Syncope when configured to store user passwords in the internal database with AES encryption.
Apache Syncope Vulnerability
While this configuration option is not enabled by default, organizations that have specifically enabled this feature face a serious risk.
When AES encryption is active, the system relies on a hardcoded default key value embedded directly in the source code.
This design flaw means that any attacker gaining access to the internal database can easily reconstruct the original cleartext password values using the publicly known default encryption key.
The vulnerability does not affect encrypted plain attributes, which use a separate AES encryption mechanism and remain secure even in compromised scenarios.
Parameter Details CVE ID CVE-2025-65998 Vulnerability Title Apache Syncope Hardcoded Encryption Key Allows Password Recovery Affected Products Apache Syncope (org.apache.syncope.core:syncope-core-spring) Vulnerability Type Use of Hardcoded Cryptographic Key (CWE-798) Impact Confidentiality Breach – Password Recovery CVSS v3.1 Base Score 7.5 (High) – Database Compromise Organizations running these versions with AES password encryption enabled should prioritize immediate remediation. Apache Syncope has released patched versions addressing this vulnerability.
Users should upgrade to version 3.0.15 or 4.0.3, which completely fixes this issue. Administrators should first inventory their deployments to identify whether AES password encryption is currently enabled.
If enabled, upgrading to the patched versions is critical to prevent password compromise. This vulnerability has a significant severity rating due to its potential for widespread credential theft.
Any attacker with database access can leverage the hardcoded encryption key to decrypt stored passwords, potentially compromising all user accounts in affected systems.
This is particularly dangerous for organizations that manage large user populations or handle sensitive identity data.
Organizations using Apache Syncope should immediately review their encryption configuration and apply the latest security patches.
Security teams should also conduct password audits for users whose credentials may have been exposed during the vulnerable period.
Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.
The post Apache Syncope Vulnerability Allows Attacker to Access Internal Database Content appeared first on Cyber Security News.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
The Air Force aims to keep its aging C-5 and C-17 airlifters flying years longer than planned as it awaits a next-gen replacement, officials said in recently released documents. That’s alarming some former mobility leaders.
A Nov. 19 solicitation memo says the C-5 Galaxy will fly until 2045 and the C-17 Globemaster until 2075, longer than previously planned, to ensure that the Air Force has enough airlift capacity while it waits for the Next-Generation Airlift aircraft.
NGAL is to reach production no earlier than 2038 and initial operating capacity three years after that. “To mitigate risks associated with acquisition delays, funding uncertainties, or technological challenges, the existing C-5M and C-17A fleets’ operational viability must be maintained until a fully capable replacement is fielded, which may require extending the service life and associated Military Type Certificate (MTC) of each platform,” the memo states.
The plan is to retire one C-5 as each new NGAL arrives, then do the same with the C-17s.
But keeping some of the Air Force’s oldest transport airframes in the skies is already a major effort, former service officials told Defense One. Maintenance hurdles, mission-capability rates, and recent mishap stats add to the concerns.
“Why would this approach to this old problem deliver a different result than what has already happened?” said Mike Minihan, who retired last year after leading Air Mobility Command. “Have we done the analysis to ensure that the capability that we're delivering with this upgrade is actually what the warfighter needs?”
Minihan said he supports the Air Force’s efforts to field NGAL. (In May, he became an adviser to Radia, which aims to field the world’s largest cargo plane.) He also praised the memo’s acknowledgement that “uninterrupted inter-theater airlift capacity is paramount for global operations,”
But Minihan said the service needs to prioritize its future airlift capabilities, not just modernizing aging aircraft.
“I'm extremely worried about what I call the equilibrium. The equilibrium between the force that supports and the force that needs supporting, or the strike forces,” Minihan said. “So you're going to have fifth- and sixth-generation bombers and fighters, and you're still on generation-two airlifters and tankers.”
The C-5 entered service in 1970. After the AIr Force concluded in 2004 that the Galaxy still had decades of life, the remaining 52 airframes were re-engined and upgraded between 2006 and 2018. But last year, the type managed only a 48 percent mission-capable rate, thanks to maintenance and supply-chain problems that kept some airframes in the depot for 900 days. The Air Force Life Cycle Management even started a campaign, “Drive to 55.” to boost that rate to 55 percent.
Minihan has publicly argued that the Air Force should sell its C-5s to private companies, then charter them from time to time, as a way to “relieve the C-17.”
The C-17, which entered service in 1995, has a more reliable mission-capable rate of 75 percent. But in the past four years, Globemasters have been involved in 21 class-A mishaps—the deadliest and costliest incidents—more than any of the military’s most-used planes.
Jessica Ruttenber, a former Air Force pilot and program manager who oversaw the C-5 and C-17 portfolios, said she was unsurprised by the service’s call to extend the life of the two transports, but said the cost of doing so would continue to be high.
“It’s a grandfather jet, so it doesn’t surprise me one bit,” Ruttenber said. “The thing that concerns me for the C-5 and the C-17…is the maintenance cost and the upkeep.”
Responses to the NGAL solicitation are due in about two months, and the analysis of alternatives is to take place in 2027, the memo said.
]]>¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Russia’s war on Ukraine has yielded troves of battlefield data, but Kyiv has no efficient way to share it with NATO friends. The alliance aims to fix that in the new year.
“Ukraine has a lot of data that they want to give to NATO” as part of a joint training center in Poland, said Tom Goffus, the alliance’s assistant secretary general for operations, during a Missile Defense Advocacy Alliance virtual event on Monday. “We're doing a cloud solution for that…to be able to handle large amounts of data from the Ukraine battlefield. And we're hoping that it's going to be operational on NATO cloud in January of 2026.”
The final hurdle involves process, not technology.
“They've got all the equipment to do it,” Goffus said. “What we don't have…is we don't yet have a policy on how to accredit it. How can you accredit this system in order to use it in a safe manner? All of our tools are designed for network-centric security, and we want to go to cloud-centric security, and so that's one of our biggest challenges.”
The plan is to learn from big cloud service providers in the U.S. that operate classified clouds for national security. The Pentagon has also been working on improving secure communications with allies and partners.
“I'm going to be talking to some of the hyperscalers who have done this already in the U.S. system. There are secure clouds out there, nationally, at the secret and even higher level. So this is figuring out an accreditation process to go along with the capability and essentially get the culture, the process and the policy to catch up with what's available out there.”
Goffus said the goal is to build everything from scratch to avoid inheriting the “limitations” of existing networks. Also, while the aim is to use commercially available systems with open architecture—that is, they can interface with products regardless of what company made them—the government has to be the owner, ultimately.
“It has to be brand-new. It is not system-of-systems. It's not a federated system of systems—many of our federated system-of-systems are actually proprietary, which makes it harder for things to talk to each other,” he said. “But I do want to stress that this has to, in the end, be government defined and government owned, though it is commercial solutions. And we need to be the gatekeepers on that.”
The proliferation of data generated and used on the modern battlefield from fighter jets to drones to ships has increased the need for militaries to be able to access, analyze and transfer information quickly (even for medical responses).
And for NATO, the vision is to integrate the data from partner nations and provide that central cloud-based solution, Goffus said.
“I think NATO needs to have a cloud solution, [an] open architecture way of integrating things that the nations buy. The nations buy the sensors. They buy that sensor suite, sensor system that feeds the data. But NATO does the data integration and makes it all good,” he said. “The strategy overall right now would be more in that line, and that common funding would go to help make sure that we have that data backbone, that common data layer that everybody can pull from.”
]]>¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
U.S. soldiers deployed to Europe had a busy November testing out counter-drone systems that the service hopes to get into the hands of more NATO allies, as well as with units and allies as far away as the Indo-Pacific.
First Polish, Romanian, and American troops trained together Nov. 18 in Poland on Merops, an AI-enabled, pickup-truck-transportable system that identifies enemy drones, then launches a cheap fixed-wing drone to ram them. At the same time, the Army held Operation Flytrap 4.5 in Germany, a competition of 20 cUAS contenders in a competition for one of four $350,000 prizes.
“It also demonstrated our capability, just as Flytrap did, to integrate with industry, to move very quickly to employ a capability that's lethal,” Brig. Gen. Curt King, who leads the 10th Army Air and Missile Defense Command in Germany, told reporters Tuesday. “It can defeat the Shahed-type threats, but also it demonstrates our ability to place capabilities that are much cheaper than some of our other previous systems that we've been using to date, to ensure that we are able to build the capacity against the drone threats that could be placed into the air.”
The U.S. has been using air defense systems to shoot down drones, with missiles that cost millions of dollars each. A Merops interceptor drone costs about $15,000, about half the price of the Shaheds that Ukrainians have been shooting down with it.
“The other thing that we demonstrated with Flytrap, and that Ukraine has shown us … is the technology is rapidly evolving so that we can get to enhanced decision aids and autonomy, which Ukraine has been rapidly developing, so that I don't need 10 soldiers to do a function,” King said.
Both events included the team from the Global Tactical Edge Acquisition Directorate, a nascent procurement system that plans to create a marketplace where units can buy the systems that are vetted and approved through events like Project Flytrap.
“We're not just stopping with the counter-UAS fight,” Col. Christopher Hill, senior director of the GTEAD, told reporters. “Next up on the list is ground autonomy and ground launched effects, as I mentioned earlier, the offensive systems that we're going to use to create a dilemma for our adversaries. Then we're going to move to air autonomy and air-launched effects—again, another offensive system to provide a dilemma.”
The team is expanding to Indo-Pacific Command early next year, Hill said.
“We're going to replicate the same processes there in the Pacific region, in order to not only support our U.S. unit there, but also our international partners in Australia, in South Korea and in Japan, and other partners there in the region,” he said.
Beyond demonstrations, GTEAD plans to have soldiers lead assessments and give feedback so that systems can be tweaked and then put on the marketplace.
“On the back end of these demonstrations, be prepared, from an acquisition standpoint, to actually put dollars towards these capabilities and give these companies something to look forward to from a contract standpoint,” he said.
]]>¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Horsham, United Kingdom, November 25th, 2025, CyberNewsWire Detego Global, the company behind the award-winning Unified Digital Forensics Platform, is proud to announce the launch of Detego Case Manager for DFIR, a powerful, purpose-built platform designed to meet the evolving demands of digital forensics and incident response (DFIR) teams worldwide. Developed in close collaboration with investigative […]
The post Detego Global Launches Case Management Platform for Digital Forensics and Incident Response Teams appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Horsham, United Kingdom, November 25th, 2025, CyberNewsWire
Detego Global, the company behind the award-winning Unified Digital Forensics Platform, is proud to announce the launch of Detego Case Manager for DFIR, a powerful, purpose-built platform designed to meet the evolving demands of digital forensics and incident response (DFIR) teams worldwide.
Developed in close collaboration with investigative professionals, Detego Case Manager for DFIR addresses the real-world challenges of managing high-volume, complex digital investigations across multiple locations and touchpoints, whether on scene or in the laboratory.
Detego Global’s new platform delivers full-spectrum case management from a tailored perspective. It brings together evidence tracking, audit logging, workflow automation, task and performance management, compliance controls, and more, all within one secure and highly auditable system.
Team leaders and administrators can access instant metrics on all cases within seconds, providing real-time visibility into efficiency and enabling swift, data-backed decision-making.
“We’ve worked hand in hand with digital forensic investigators, incident responders, law enforcement, military, and corporate professionals to design a platform that truly meets the operational demands they face every day,” said Alex Kirk, Global Sales Director of Detego Global.
“Detego Case Manager for DFIR reflects the practical input of experts worldwide, combining streamlined workflows with powerful data insights and compliance features that modern investigations require.”
Key features include:
- Fully compliant/audit-friendly investigation management with timestamped notes and specifics, full audit trails, and an unbroken chain of custody
- Customisable, pre-built workflows designed by DFIR experts and a visual workflow builder to streamline and accelerate investigations
- Centralised evidence and data collection, unifying physical and digital exhibits, ISO-compliant forms, and seamless integration of evidence from third-party tools
- Smart task management with Kanban-style tracking, automation, role-based permissions, escalation paths, and collaboration tools for full visibility and accountability
- Entity management that maps and traces relationships across people, devices, locations, and cases to uncover hidden links and patterns
- Built-in insights and reporting, including real-time performance metrics, case timelines, dashboards, and logs to support informed decision-making, efficient resource allocation, and early identification and elimination of bottlenecks
The platform is available as an on-premise or cloud-hosted solution and includes optional add-ons such as custom workflow development and database integrations.
Detego Case Manager for DFIR can be deployed rapidly, with tailored onboarding, user guides and ongoing support to ensure immediate operational impact. A fully functional 30-day trial is also available.
Detego Case Manager for DFIR sets a new benchmark in digital investigation management, delivering control, clarity, and consistency across every stage of the forensic life cycle.
To request a trial, users can visit: https://detegoglobal.com/cmtrial/
https://player.vimeo.com/video/1111243018 (embedded video)
About Detego Global
Detego Global is the company behind the Detego Unified Digital Forensics Platform and Detego Case Manager. These solutions are trusted by military, law enforcement, and enterprise teams in more than 70 countries.
The company’s technologies enable investigators to swiftly triage devices, rapidly extract and analyse digital evidence at scale, and streamline every aspect of investigations.
Detego Global enables investigative teams to combat serious crimes, including child exploitation, human trafficking, terrorism, and fraud, with greater speed and accuracy.
Contact
Director of Marketing
Buddhika Karunasekara
Detego Global
budd.karunasekara@detegoglobal.com
The post Detego Global Launches Case Management Platform for Digital Forensics and Incident Response Teams appeared first on Cyber Security News.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A major accounting and financial services provider disclosed a significant data breach affecting client business records and sensitive corporate documents.
The incident occurred on or about November 12, 2025, but the company only announced the breach publicly on November 22, 2025.
The breach exposed accounting records and legal agreements belonging to SitusAMC clients. The company confirmed that specific corporate data associated with clients’ relationships with the firm was compromised.
Client Accounting Records Compromised in Major Breach
Additionally, data relating to some clients’ customers may have been affected, though the full scope remains under investigation.
SitusAMC stressed that no encrypting malware was involved in the attack, and their services remain fully operational.
The company worked with leading cybersecurity experts and federal law enforcement to contain the incident immediately after detection.
Following the discovery, SitusAMC launched an immediate investigation with third-party security advisors and notified federal law enforcement authorities.
The company implemented several security hardening measures, including credential resets, turning off remote access tools, updating firewall rules, and strengthening security settings across its systems.
“We take this matter and the security of our clients’ information very seriously,” SitusAMC stated in a customer notice.
The company maintained that all systems were secured and services remained uninterrupted throughout the incident. SitusAMC confirmed that it has directly communicated with affected clients about the breach.
The company acknowledged that while certain client data was compromised, the specific nature and extent of the impact remain under investigation.
Clients were instructed to contact the company’s security team at securitynotice@situsamc.com for additional information or concerns.
The 10-day gap between discovery (November 12) and public disclosure (November 22) allowed SitusAMC time to investigate the incident and notify law enforcement before disclosing the breach.
The company indicated it would provide additional updates as the investigation progresses and new information becomes available.
This breach highlights the ongoing security risks facing financial services companies and the importance of robust data protection measures for firms handling sensitive accounting and legal documents.
Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.
The post Retail Finance Giant SitusAMC Data Breach Exposes Accounting Records and Legal Agreements appeared first on Cyber Security News.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶


