• F5, a leading provider of application security and delivery solutions, disclosed a major security incident. The company revealed that a sophisticated nation-state threat actor had gained long-term access to internal systems, exfiltrating sensitive files including BIG-IP source code and details on undisclosed vulnerabilities.

    While F5 emphasized that no critical exploits or active attacks on customers have been detected, the breach underscores the vulnerabilities in even the most secure development environments.

    The intrusion, discovered in August 2025, involved persistent access to F5’s BIG-IP product development environment and engineering knowledge management platforms.

    According to the company’s official statement, the actor downloaded files containing proprietary source code for its flagship BIG-IP software, which powers load balancing and security for millions of enterprise applications worldwide.

    Additionally, the stolen data included information on vulnerabilities that F5 was actively researching and patching. However, the firm stressed that these were not critical remote code execution flaws and showed no signs of exploitation in the wild.

    Breach Details

    F5’s investigation, aided by cybersecurity CrowdStrike and Mandiant, found no evidence of tampering with the software supply chain, including build pipelines or released code.

    Independent audits by NCC Group and IOActive corroborated this, ruling out modifications that could have introduced backdoors into customer deployments. The breach also spared key areas like NGINX source code, F5 Distributed Cloud Services, and Silverline DDoS protection systems.

    However, some fallout reached customers. A small subset of exfiltrated files from the knowledge platform held configuration details for certain BIG-IP implementations.

    F5 plans to notify affected users directly after reviewing the data. Crucially, no customer records from CRM, financial systems, support portals, or the iHealth monitoring tool were compromised, limiting broader privacy risks.

    F5 acted swiftly to contain the threat, rotating credentials, bolstering access controls, and deploying advanced monitoring tools. No further unauthorized activity has occurred since containment.

    To safeguard users, the company rolled out urgent patches for BIG-IP, F5OS, BIG-IP Next for Kubernetes, BIG-IQ, and APM clients in its October 2025 Quarterly Security Notification. Customers are urged to apply these updates immediately, even in the absence of known exploits.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post F5 Breached – Hackers Stole BIG-IP Source Code and Undisclosed Vulnerabilities Data appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The GhostBat RAT campaign has emerged as a sophisticated threat targeting Indian Android users through counterfeit Regional Transport Office (RTO) applications.

    First observed in mid-2025, these malicious APKs masquerade as the official “mParivahan” app, exploiting user trust in government services.

    Distribution occurs primarily via smishing—WhatsApp messages and SMS containing shortened URLs redirecting victims to GitHub-hosted payloads—or through compromised websites.

    Malicious APKs circulating on WhatsApp (Source – Cyble)

    Once installed, the malware prompts victims to grant SMS-related permissions under the guise of essential updates, setting the stage for banking data exfiltration.

    Upon installation, the app displays a phishing interface remarkably similar to the genuine mParivahan layout.

    The victim is prompted to enter vehicle and mobile details, followed by a fake UPI payment request of ₹1 to “verify ownership.”

    Meanwhile, SMS messages containing banking-related keywords are harvested and exfiltrated to attacker-controlled servers.

    Incoming one-time passwords (OTPs) can be forwarded directly to adversaries, facilitating unauthorized transactions.

    Cyble analysts noted the incorporation of a Telegram bot, GhostBatRatbot, which registers infected devices and serves as a command channel for stolen data.

    Underneath the social engineering facade, GhostBat RAT relies on multiple anti-analysis and obfuscation tactics.

    The initial dropper performs anti-emulation checks by interrogating Build.CPU_ABI and Build.MANUFACTURER values, terminating execution if an emulator is detected.

    Sample code from this stage illustrates the heavy string obfuscation and emulator avoidance logic:

    public static boolean isRealDevice(String abi) {
        if (abi.equals("x86") || abi.equals("x86_64")) {
            return false;
        }
        String manufacturer = Build.MANUFACTURER.toLowerCase(Locale.ROOT);
        if (manufacturer.contains("generic") || manufacturer.contains("emulator")) {
            return false;
        }
        return true;
    }
    Malware implemented anti-emulation techniques (Source – Cyble)

    A multi-stage dropper then decrypts embedded payloads using XOR operations and dynamic DexClassLoader loading, ensuring detection evasion.

    Native libraries (.so) further complicate analysis by reconstructing API calls in memory via JNI. These layers collectively hinder reverse engineering and antivirus detection.

    GhostBat RAT’s Infection Mechanism

    Here the complete infection mechanism leverages smishing URLs disguised as RTO services. Upon clicking a shortened link, users download an APK hosted on GitHub or similar platforms.

    The installer requests SMS-read and SMS-send permissions, which victims often grant under the pretext of service functionality.

    Once permissions are in place, the dropper decrypts its second-stage payload:-

    InputStream in = context.getAssets().open("encrypted_payload");
    byte[] data = new byte[in.available()];
    in.read(data);
    in.close();
    byte[] key = MessageDigest.getInstance("SHA-1")
        .digest("encrypted_payload".getBytes(StandardCharsets.UTF_8));
    for (int i = 0; i < data.length; i++) {
        data[i] ^= key[i % key.length];
    }
    DexClassLoader loader = new DexClassLoader(
        saveToFile(data), context.getCacheDir().getAbsolutePath(),
        null, context.getClassLoader()
    );

    This decrypted component houses the credential stealer and cryptominer modules, which are loaded dynamically.

    The final payload mimics a genuine app update page, tricking users into installing the malicious mParivahan app.

    By chaining these stages, GhostBat RAT achieves stealthy installation and robust persistence, making it a significant risk to Indian mobile banking users.

    Follow us on Google NewsLinkedIn, and X to Get More Instant UpdatesSet CSN as a Preferred Source in Google.

    The post GhostBat RAT Android Malware With Fake RTO Apps Steals Targeting Indian Users to Steal Banking Data appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A sophisticated attack campaign dubbed “Operation Zero Disco,” where threat actors are actively exploiting a critical Cisco Simple Network Management Protocol (SNMP) vulnerability to install Linux rootkits on vulnerable network devices.

    Trend Micro observed an operation exploiting CVE-2025-20352, which allows remote code execution (RCE) and grants persistent unauthorized access, primarily targeting older Cisco switches that lack modern protections.

    As of October 2025, the campaign has impacted enterprise networks, highlighting ongoing risks in legacy infrastructure.​

    The core flaw, detailed in Cisco’s security advisory, stems from a buffer overflow in the SNMP authentication framework on Cisco IOS XE Software.

    Attackers send crafted SNMP Get-Request packets to overflow the buffer, allowing arbitrary code execution on both 32-bit and 64-bit switch architectures.

    Once exploited, the malware deploys a rootkit that sets a universal password containing the term “disco” a subtle nod to “Cisco” granting attackers broad access across authentication methods like AAA and local logins.

    This password mechanism hooks into the IOSd memory space, ensuring fileless persistence that vanishes upon reboot to complicate detection.

    Cisco SNMP Vulnerability Actively Exploited

    Trend Micro’s investigation revealed attackers chaining this with a modified Telnet vulnerability derived from CVE-2017-3881, repurposed for memory read/write operations rather than outright RCE.

    For 32-bit targets like the legacy Cisco 3750G series, network captures showed fragmented SNMP packets smuggling commands, such as “$(ps -a,” limited by byte constraints per packet.

    SNMP packets smuggling commands
    SNMP packets smuggling commands

    On 64-bit platforms, including Cisco 9400 and 9300 series, exploits require elevated privileges to activate guest shells, enabling UDP-based controllers for advanced post-exploitation.

    These controllers toggle logs, bypass access controls, and conceal configuration changes, such as hiding specific ACLs (e.g., EnaQWklg0) or EEM scripts (CiscoEMX-1 through 5).​

    In simulated scenarios mirroring real-world breaches, attackers infiltrate segmented networks by exploiting default public SNMP communities on switches.

    They bypass external firewalls using stolen credentials, then target core switches to manipulate VLAN routing and perform ARP spoofing via Linux ELF binaries run in guest shells.

    SNMP 0-Day Vulnerability Actively Exploited
    SNMP 0-Day Vulnerability Actively Exploited

    By impersonating trusted waystation IPs, intruders disable logging, redirect traffic, and access protected zones like server farms without triggering internal firewalls.

    Upon exit, they restore logs and timestamps to erase traces, facilitating undetected lateral movement across DMZs, offices, and secure data areas.​

    The campaign focuses on outdated Linux-based systems without endpoint detection and response (EDR) tools, using spoofed IPs and email addresses for anonymity.

    While Address Space Layout Randomization (ASLR) on newer models thwarts some attempts, persistent probing can still succeed, as observed in Trend Micro telemetry.

    Cisco collaborated on forensics, confirming impacts on phased-out 3750G devices alongside active 9400 and 9300 lines.​

    Mitigations

    No automated tool fully detects these rootkits, so organizations should contact Cisco TAC for firmware inspections.

    Trend Micro recommends deploying Cloud One Network Security for virtual patching and intrusion prevention, alongside Deep Discovery Inspector rules like 5497 for UDP controller traffic.

    Vision One customers gain hunting queries and IoC sweeps, blocking exploits via rules such as 46396 for SNMP overflows.

    Patching CVE-2025-20352 immediately, restricting SNMP to authenticated communities, and segmenting legacy devices are critical steps.

    This operation underscores the dangers of unpatched network gear, urging enterprises to prioritize updates amid rising state-sponsored and cybercrime threats.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Cisco SNMP 0-Day Vulnerability Actively Exploited To Deploy Linux Rootkits appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The China Intelligence: What open sources tell us about Chinese forces, weapons, and strategy.

    The People's Liberation Army is building an “invisible net” across the western Pacific, a five-layer, seabed-to-space sensor architecture known as the Transparent Ocean strategy that challenges the ability of U.S. and allied submarines (our “black sharks”) to maneuver and hide.

    The threat was on display in August during the PLA Navy and Russia's Joint Sea-2025 exercises near Vladivostok. In joint anti-submarine warfare drills, Chinese and Russian forces linked their communications and shared hydro-meteorological and air-sea tracks in real time. The goal, according to Chinese state media, was to leave deep-diving submarines with nowhere to hide. 

    This exercise served as an early demonstration of a mature, automated kill web that China plans to spread across multiple seas and oceans. Intended to enable persistent, real-time tracking across vast areas, the web will consist of five layers:

    • Ocean Star Cluster (space): A constellation of satellites, centered on the Guanlan interferometric radar altimetry and ocean-profiling lidar system. This layer provides wide-area surveillance and flags specific locations, cueing the lower layers to wake up and focus.
    • Air-Sea Interface (surface/near-surface): Smart buoys, wave gliders, and unmanned surface vessels hold station across vital straits and shelves. They sample the upper ocean and act as crucial routers, translating slow underwater acoustic data packets into high-bandwidth satellite or cellular bursts for transmission ashore.
    • Starry Deep Sea (water column): Deep floats, long-range gliders, and autonomous underwater vehicles patrol below the mixed layer for weeks, profiling the ocean environment and towing acoustic payloads. They fill the gaps identified by the orbital layer.
    • Undersea Perspective (seabed): This is the backbone of the entire grid. Connected by undersea cables, observatories and hubs host passive arrays, precise clocks, and navigation beacons. They provide essential docking, data offload, and recharging for visiting vehicles, allowing unmanned submarines to loiter quietly and redeploy without surfacing, which drastically extends their endurance and reduces exposure.
    • Deep Blue Brain (data fusion): The core command layer that fuses the entire picture and orchestrates sensing. It's the tasking and decision-support hub that merges data from space, air, surface, and seabed, ready to hand targets to combat networks.

    In an influential primer, “From Kill Chain to Kill Web,” PLA theorists warn that a traditional, linear “kill chain” collapses when a single node is destroyed. Their response is the “maritime adaptive kill web,” a resilient, mesh-style network that offers multiple paths from sensor to shooter and promises instant bypasses for any node failures.

    A mature Transparent Ocean system is designed to automate this flow at scale. For instance, a Dalian Naval Academy study demonstrated a space-guided sea strike model that can compute 45 alternative paths and rank them by strike power and closure time. A PLA team developed an algorithm that reassembles broken chains by matching surviving nodes to the next‑best route. This ability to instantly reroute broken kill paths, a measurable metric for the PLA, is key to keeping the web fighting under fire. 

    This concept has moved quickly from the lab to the ocean, with a number of building blocks in the Transparent Ocean blueprint coming to fruition over the last decade. It also shows the sea-bed side of civil-military fusion efforts. 

    On the sensor side, Zhejiang University’s Zhairuoshan observatory first linked seabed probes to shore in 2014 and proved real-time undersea data flow. Today, the China Academy of Electronics and Information Technology runs a cross-domain maritime network that spans space, air, shore, surface, and subsea platforms to support situational awareness and environmental monitoring. Ocean University of China reported building the first Kuroshio Extension observation system, a chain of anchored moorings and repeat stations complemented by a roaming layer that keeps watch on one of the Western Pacific’s busiest water highways. 

    China’s extra-large uncrewed undersea vehicle, or XLUUV, effort is also maturing, with multiple large prototypes and a growing undersea force that provides the test beds to refine payloads, autonomy, and logistics for vehicles that will seed and service the sensor web. With backing from the government’s “Deep Sea Key Technologies &  Equipment” initiative, the Chinese Academy of Sciences’ Shenyang Institute of Automation kicked off “Project 912“ in 2018 to build an Orca-class XLUUV. More recently, Tianjin University’s Haiyan deep-sea gliders have shown ultra-long endurance in the Pacific, while Blue Whale wave-gliders act as surface relays, holding station for weeks and backhauling data from subsurface nodes to shore. Advances in quieting, batteries, and acoustic arrays have since moved from labs and academic settings into PLA trials, which is exactly what a kill web needs: more sensors, more routes, and faster handoffs.

    The relay tier is also growing. New cross-domain buoy designs and systems can switch among satellite links, cellular networks, and acoustic modems, closing the gap between UUVs, seabed sensors, and coastal command posts. The PLA Navy has also begun collaborating with various state-sponsored institutions to develop algorithms that enable communications buoys to select the best link on the fly and move data in real time from the water column to shore, a potential sign that a fieldable relay layer exists today.

    China is also working to develop the power systems needed for Transparent Ocean. Chinese studies stress that persistent deep-depth UUVs patrols will rely on endurance and efficiency. This mirrors Western research efforts on long-duration UUV autonomy and energy harvesting. As a result, China’s near-term priorities in the power realm include higher-specific-energy batteries, seawater metal-air cells for expendable nodes, and pierless recharging at seabed docks and cabled hubs. 

    Reliability remains the bottleneck in contested waters. Optics need clear water and precise alignment. Cellular communications die offshore. Acoustics degrade in cluttered littorals. Hence the emphasis on multi-pipe relays and “wake-up” schemes that sip milliwatts of power until needed. Recent Chinese studies describe cross-domain communication buoys that select the best link in real time, whether satellite, cellular, or acoustic. Likewise, Harbin Engineering University patents detail ultra-low-power acoustic wake-ups that let dormant nodes sleep for months and join the net only when cued. 

    The U.S. and its allies should watch for Transparent Ocean work, especially in key choke points such as the South China Sea, waters around Taiwan, the Luzon Strait, the Straits of Malacca, and approaches to Guam.

    A wider, denser and more effective Chinese sensor network will leave allied submarines with fewer places to hide, while faster cue-to-fire loops shrink the window within which they can be targeted. This will significantly complicate operations not just in a potential future war, but also peacetime covert and intelligence-surveillance-reconnaissance operations. 

    To contend with the changing seas, the United States and its allies should adopt a “mesh-vs-mesh” approach that recognizes that hiding is a shrinking option and instead builds on twin pillars of counter-sensing and counter-UUV operations. Each will require the U.S. Navy and its allies to develop new tactics and doctrine. Sensors can be foiled with deception and jamming, along with building more resilient, interoperable communications. In turn, UUVs can themselves be hunted, disrupted or even defeated through both kinetic and electromagnetic means. 

    Working with partners in the region will also be essential to out-cycle Beijing’s new web of observation. Australia’s Ghost Shark can send payload-capable UUVs forward, while Japanese investments in long-range underwater communications can strengthen command and control around the Ryukyu Arc. 

    Allies should stitch these efforts into more cohesive acquisitions and a shared, rehearsed playbook. Near-term priorities must include joint deception drills and seabed docking trials that remove human logistics from long-endurance UUV operation, as well as being prepared to deploy or even pre-position counter-UUV patrol boxes where PLA buoys and gliders already operate.

    Tye Graham is a Senior Researcher with BluePath Labs and a retired U.S. Army Foreign Area Officer.

    P.W. Singer is Strategist at New America and the author of multiple books on technology and security, including Wired for War, Ghost Fleet, Burn-In, and LikeWar: The Weaponization of Social Media.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The following is a joint statement by defense publications regarding the Pentagon’s new restrictions on media. Released on Oct. 15, 2025, the statement is co-signed by Defense One.

    For decades, the defense trade media has been a trusted source of news and insight about Defense Department programs, budgets, and strategy. Ethical, accurate, and timely reporting makes that possible. The public, industry, and indeed the department itself benefit from granting credentialed defense reporters access to unclassified areas in the Pentagon and from the trust engendered by that access.

    The Pentagon has been seeking to impose unprecedented restrictions on journalists’ ability to cover the military for several months. Having restricted where unescorted media may go in the Pentagon—such that even visiting the public affairs offices of the military services now requires an escort—department leaders are asking reporters to sign a document acknowledging a vague new policy that, on its face, appears to contravene the First Amendment. This policy threatens to punish reporters who ask legitimate questions in the course of their daily work and to impose material harm on our news organizations for factual reporting.

    Journalists from the undersigned defense trade publications will not sign this new policy. Our newsrooms will continue to cover topics of military, defense, and national security fairly and independently.

    • Aviation Week 
    • Breaking Defense
    • Defense Daily
    • Defense One
    • Defense News
    • Inside Defense
    • Military Times
    • USNI News

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • New research has uncovered that publishers of over 100 Visual Studio Code (VS Code) extensions leaked access tokens that could be exploited by bad actors to update the extensions, posing a critical software supply chain risk. “A leaked VSCode Marketplace or Open VSX PAT [personal access token] allows an attacker to directly distribute a malicious extension update across the entire install base,”

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent alert on October 14, 2025, highlighting a critical vulnerability in Rapid7’s Velociraptor endpoint detection and response (EDR) tool.

    This flaw, stemming from incorrect default permissions, has already been weaponized by threat actors to execute arbitrary commands and seize control of infected endpoints, amplifying risks for organizations relying on the open-source security platform.

    Velociraptor, popular among security teams for its forensic capabilities and artifact collection, suffers from a misconfiguration that allows authenticated users with artifact collection privileges to escalate their access.

    According to CISA’s Known Exploited Vulnerabilities (KEV) catalog, exploitation requires initial access to the endpoint but can lead to full takeover once inside.

    The vulnerability ties to CVE-2025-6264, which addresses improper handling of permissions, making it a classic case of default settings gone awry.

    Rapid7 acknowledged the issue in a recent advisory, urging users to update to version 0.7.1 or later, where stricter permission controls have been implemented.

    What makes this vulnerability particularly alarming is its confirmed use in ransomware campaigns. Threat groups, including those linked to LockBit and Conti variants, have exploited it to pivot from initial footholds into devastating network-wide infections.

    Security researchers at Mandiant reported instances where attackers used Velociraptor’s own artifact-gathering features against defenders, injecting malicious payloads that evaded traditional detection.

    In one documented case from late September 2025, a mid-sized financial firm lost endpoint visibility entirely after ransomware operators commandeered the tool, leading to data exfiltration and encryption across 500 devices.

    This incident underscores a troubling trend: adversaries increasingly target security software itself. By compromising EDR platforms like Velociraptor, attackers not only neutralize defenses but also gain reconnaissance advantages.

    CISA emphasized that unpatched systems face heightened risks, especially in sectors like healthcare and critical infrastructure, where endpoint monitoring is vital.

    Mitigations

    CISA recommends applying Rapid7’s patches immediately, enforcing least-privilege access for artifact collection, and adhering to Binding Operational Directive (BOD) 22-01 for cloud-based services.

    If mitigations prove infeasible, discontinuing use of the affected product is advised. The agency set a due date of November 4, 2025, for federal agencies to address the vulnerability, signaling its severity.

    Experts warn that this exploit highlights the double-edged sword of open-source tools: powerful yet prone to configuration pitfalls.

    As ransomware evolves, blending social engineering with technical exploits, defenders must prioritize rigorous permission audits.

    Rapid7 has maintained its documentation with step-by-step hardening guides, but proactive monitoring remains key. With attacks surging 30% year-over-year per recent reports, this CISA warning serves as a call to fortify the very tools meant to protect us.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post CISA Warns Of Rapid7 Velociraptor Vulnerability Exploited in Ransomware Attacks appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A major manufacturing company fell victim to a swift and devastating ransomware attack after threat actors gained access using just one set of stolen VPN credentials. The attack, carried out by the cybercrime group Ignoble Scorpius, culminated in widespread encryption of virtual machines and brought critical operations to a halt. The Initial Compromise The breach […]

    The post BlackSuit Ransomware Breaches Corporate Network Using Single Compromised VPN Credential appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The BlackSuit ransomware group, tracked as Ignoble Scorpius by cybersecurity experts, devastated a prominent manufacturer’s operations.

    The attack, detailed in a recent Unit 42 report from Palo Alto Networks, began with something as simple as compromised VPN credentials, escalating into widespread encryption and data theft that could have cost millions.

    This incident underscores the escalating sophistication of ransomware actors and the urgent need for layered defenses in today’s threat landscape.

    The breach kicked off with a classic voice phishing scam, or vishing. An attacker posed as the company’s IT help desk, convincing an unwitting employee to input their real VPN login on a fake phishing site.

    Once inside, the intruder wasted no time. They launched a DCSync attack on a domain controller, siphoning off elite credentials like those of a key service account.

    From there, lateral movement was swift: using Remote Desktop Protocol (RDP) and Server Message Block (SMB), the hackers deployed tools such as Advanced IP Scanner to chart the network and SMBExec to exploit vulnerabilities.

    Persistence came next, with the attackers installing legitimate remote access software like AnyDesk alongside a custom remote access trojan (RAT) on a domain controller, disguised as a scheduled task to dodge reboots.

    They hit a second domain controller hard, dumping the NTDS.dit database full of password hashes. Over 400 GB of sensitive data vanished via a rebranded rclone tool.

    60+ VMware ESXi Hosts Breached

    To erase their footprints, they ran CCleaner before the knockout punch: BlackSuit ransomware, automated through Ansible playbooks, locked down hundreds of virtual machines across about 60 VMware ESXi hosts.

    Their probe revealed critical gaps, leading to targeted fixes: swapping outdated Cisco ASA firewalls for next-gen models, enforcing network segmentation, and limiting admin access to isolated VLANs.

    On identity fronts, they pushed multifactor authentication (MFA) for all remote logins, NTLM disabling, credential rotations, and bans on service accounts for interactive sessions like RDP.

    The client successfully avoided a $20 million ransom demand, thanks to Unit 42’s expertise, while also gaining enterprise-wide monitoring and ongoing managed detection services.

    This story shows a harsh truth: one stolen credential can cause a chain reaction of problems. Groups like Ignoble Scorpius take advantage of such mistakes, using simple tools and ransomware to create maximum disruption.

    Organizations need to prioritize multi-factor authentication, proactive assessments, and automated responses to effectively combat ransomware. As this threat evolves, it is essential to enhance defenses before the next vishing call leads to a similar outcome.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post BlackSuit Ransomware Actors Breached Corporate Environment, Including 60+ VMware ESXi Hosts appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The Cybersecurity and Infrastructure Security Agency has added a critical vulnerability in Rapid7 Velociraptor to its Known Exploited Vulnerabilities catalogue, warning that threat actors are actively exploiting the flaw in ransomware attacks. The vulnerability, tracked as CVE-2025-6264, was added to the catalogue on October 14, 2025, giving federal agencies until November 4 to implement necessary […]

    The post CISA Alerts on Rapid7 Velociraptor Flaw Exploited in Ransomware Campaigns appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶