A threat actor has claimed responsibility for breaching HSBC USA, the American division of the global investment bank and financial services holding company. The cybercriminal posted an extensive database for sale on underground forums, alleging it contains fresh and comprehensive customer data stolen from the financial institution. Massive Collection of Sensitive Customer Data According to […]
BeyondTrust’s annual cybersecurity predictions point to a year where old defenses will fail quietly, and new attack vectors will surge.
Introduction
The next major breach won’t be a phished password. It will be the result of a massive, unmanaged identity debt. This debt takes many forms: it’s the “ghost” identity from a 2015 breach lurking in your IAM, the privilege sprawl from thousands of new
Organizations in Ukraine have been targeted by threat actors of Russian origin with an aim to siphon sensitive data and maintain persistent access to compromised networks.
The activity, according to a new report from the Symantec and Carbon Black Threat Hunter Team, targeted a large business services organization for two months and a local government entity in the country for a week.
The attacks
Researchers have unveiled a groundbreaking attack dubbed “TEE.fail” that fundamentally compromises the security guarantees of Trusted Execution Environments (TEEs) from Intel and AMD by exploiting DDR5 memory architecture. The attack demonstrates how even the most advanced hardware-backed security features can be defeated using surprisingly accessible electronic equipment, raising critical questions about the future of confidential […]
A persistent vulnerability related to DLL hijacking has been identified in the Narrator accessibility tool, which has been a significant concern over time.
This flaw allows malicious actors to exploit the tool, potentially compromising the security of systems that rely on it for accessibility features.
Noted initially in reports dating back to 2013 by expert Hexacorn, the flaw persists in modern Windows 10 and 11 versions, allowing attackers with local administrator privileges to achieve stealthy code execution, system persistence, and even remote lateral movement.
TrustedSec discovery, inspired by mining tactics from VX-Underground repositories, highlights how everyday accessibility features can be weaponized for malicious ends.
The technique exploits Narrator.exe’s loading of the MSTTSLocOneCoreEnUS.dll from the path %windir%\system32\speech_onecore\engines\tts.
By replacing this DLL with a malicious version, attackers can execute arbitrary code upon Narrator launch, without requiring any exports.
The DLL’s DllMain attach function triggers the payload, but researchers refined it to suspend Narrator’s main thread, silencing the tool’s voice output and preventing visual cues that could alert users.
A proof-of-concept on GitHub demonstrates this evasion, freezing Narrator while running custom code undetected.
User-Level Persistence via Registry Tweaks
Attackers can embed this hijack to automatically execute at logon by modifying the registry.
Under HKCU\Software\Microsoft\Windows NT\CurrentVersion\Accessibility, creating a REG_SZ value named “configuration” set to “Narrator” triggers the DLL on user login.
TrustedSec tests confirmed seamless persistence post-logoff, with the malicious DLL loading silently. This method requires no elevated privileges beyond initial access, making it ideal for maintaining footholds in user contexts.
For broader impact, the technique extends to SYSTEM-level persistence by applying the same registry change under HKLM, launching Narrator at the login screen with elevated privileges.
Lateral movement adds another layer: attackers with remote registry access via tools like Impacket can deploy the DLL and alter HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\SecurityLayer to 0.
RDP connection to the target then allows triggering Narrator via Ctrl+Win+Enter at login, executing the payload as SYSTEM before the session closes, forcing quick process migration for sustained access.
Researchers also demonstrated “Bring Your Own Accessibility,” crafting custom accessibility tools (ATs) via registry exports and imports, pointing to arbitrary executables, even UNC network paths for remote payload delivery.
Triggering via ATBroker.exe /start further enhances flexibility. While no CVE has been assigned yet, this underscores the risks of unpatched legacy behaviors in accessibility features, urging organizations to monitor registry changes and DLL paths rigorously.
Artificial Intelligence (AI) is rapidly transforming Governance, Risk, and Compliance (GRC). It’s no longer a future concept—it’s here, and it’s already reshaping how teams operate.
AI’s capabilities are profound: it’s speeding up audits, flagging critical risks faster, and drastically cutting down on time-consuming manual work. This leads to greater efficiency, higher accuracy, and a more
A path traversal vulnerability discovered in Docker Compose allows attackers to write arbitrary files to host systems through specially crafted OCI artifacts. Tracked as CVE-2025-62725, the flaw was discovered in early October 2025 and carries a high severity rating of 8.9 CVSS. CVE ID CVE-2025-62725 Component Docker Compose OCI Artifacts Vulnerability Type Path Traversal / […]
Tata Motors, India’s largest automaker and a major player in the global automotive industry, suffered a catastrophic data exposure that revealed over 70 terabytes of sensitive information through multiple security failures. The breaches, discovered in 2023, involved exposed AWS credentials on public-facing websites, encrypted keys that were easily decrypted, a Tableau backdoor with zero authentication […]
CISA has added two critical vulnerabilities affecting Dassault Systèmes DELMIA Apriso to its Known Exploited Vulnerabilities catalog, warning that threat actors are actively exploiting these security flaws in real-world attacks.
The alert, issued on October 28, 2025, requires federal agencies to implement mitigations by November 18, 2025, while urging all organizations using the affected software to take immediate action.
DELMIA Apriso, a widely deployed manufacturing operations management platform used by enterprises worldwide, has become the target of sophisticated cyberattacks exploiting two distinct vulnerabilities.
Active Exploitation of Manufacturing Software
The first flaw, tracked as CVE-2025-6204, is a code injection vulnerability (CWE-94) that enables attackers to execute arbitrary code on vulnerable systems.
This type of weakness allows malicious actors to inject and run unauthorized commands, potentially leading to complete system compromise.
The second vulnerability, CVE-2025-6205, involves missing authorization controls categorized as CWE-862.
CVE ID
Product
Vulnerability Type
CVE-2025-6204
Dassault Systèmes DELMIA Apriso
Code Injection
CVE-2025-6205
Dassault Systèmes DELMIA Apriso
Missing Authorization
This security gap permits attackers to bypass authentication mechanisms and gain elevated privileges within the application without proper credentials.
When combined, these vulnerabilities create a dangerous attack surface that could allow threat actors to infiltrate manufacturing environments, manipulate production data, or deploy ransomware across industrial networks.
CISA’s inclusion of these vulnerabilities in the KEV catalog signals confirmed exploitation in active attack campaigns, though details about specific incidents remain undisclosed.
The agency has mandated that federal civilian executive branch agencies apply vendor-supplied patches or mitigations within three weeks.
For organizations using cloud-based deployments, CISA recommends following Binding Operational Directive 22-01 guidance, which addresses security requirements for cloud services.
Organizations unable to apply patches are advised to discontinue use of the affected product until secure configurations can be implemented.
The 21-day remediation window reflects the serious nature of these actively exploited vulnerabilities and the elevated risk they pose to manufacturing operations and supply chain security.
Security teams should prioritize patching DELMIA Apriso installations, particularly those accessible from internet-facing networks or connected to critical manufacturing processes.
Organizations should also review access logs for suspicious activity, implement network segmentation to isolate manufacturing systems, and monitor for unauthorized code execution or privilege escalation attempts.
Given the active exploitation status, defenders must assume threat actors are scanning for vulnerable instances and act swiftly to close these security gaps before attackers can establish persistent access to industrial control environments.
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical security alert regarding two severe vulnerabilities discovered in Dassault Systèmes DELMIA Apriso, a widely used manufacturing execution system. The agency has added these flaws to its official list of vulnerabilities that pose immediate risks to organisations and require urgent mitigation action. CVE ID Product […]
