Cyber Security News

Makop ransomware, a strain of the Phobos malware family first spotted in 2020, continues to evolve into a significant threat to businesses worldwide. Recent analysis reveals that attackers are combining brute-force RDP attacks with sophisticated privilege escalation techniques and security bypass tools to compromise organizations. The majority of attacks, representing 55 percent of all incidents, […]

The post Makop Ransomware Exploits RDP Systems with AV Killer and Other Exploits appeared first on Cyber Security News.

A sophisticated cyber campaign is exploiting search engine optimization (SEO) to distribute a malicious installer disguised as Microsoft Teams, targeting unsuspecting organizations. This campaign, active since November 2025, uses a fake Microsoft Teams website to lure users into downloading a trojanized application, which then deploys the “ValleyRAT” malware. This malware gives attackers remote control over […]

The post Threat Actors Poisoning SEO Results to Attack Organizations With Fake Microsoft Teams Installer appeared first on Cyber Security News.

Ivanti has officially released urgent security updates for its Endpoint Manager (EPM) solution to address four distinct security flaws. The latest advisory highlights one critical vulnerability and three high-severity issues that could allow attackers to execute arbitrary code, write files on the server, or bypass security restrictions. While the company confirmed that it is not […]

The post Ivanti Security Update: Patch for Code Execution Vulnerabilities in Endpoint Manager appeared first on Cyber Security News.

The GOLD BLADE threat group has shifted from pure espionage to a hybrid model that combines data theft with targeted ransomware attacks using a custom locker called QWCrypt. This shift follows a long-running campaign tracked as STAC6565, which hit almost 40 victims between early 2024 and mid‑2025, with a strong focus on Canadian organizations and […]

The post GOLD BLADE Using Custom QWCrypt Locker that Allows Data Exfiltration and Ransomware Deployment appeared first on Cyber Security News.

A new wave of ransomware attacks targeting virtual machine platforms has emerged, with the Akira ransomware group leading a campaign against Hyper-V and VMware ESXi systems. These attacks pose a growing threat to enterprise environments that rely on virtualization for critical operations. The group has developed specialized tools to quickly encrypt virtual machines, causing widespread […]

The post Ransomware Targeting Hyper-V and VMware ESXi Surges as Akira Group Exploits System Vulnerabilities appeared first on Cyber Security News.

Security teams today struggle with a paradox. Threat volumes keep climbing, but most of what hits SIEMs and inboxes is noise: indicators stripped of meaning, alerts detached from context, and threat data that treats every organization as if it faces the same risks.  For CISOs, SOC and MSSP leads, this lack of context has a measurable cost. Teams spend too much time […]

The post See Cyber Threats to Your Company’s Industry & Region in 2 Seconds appeared first on Cyber Security News.

Microsoft is set to introduce a significant security enhancement to its Teams platform that will empower users to flag potentially malicious or unsolicited calls. This upcoming feature, “Report a Suspicious Call,” is designed to strengthen the platform’s defenses against fraudulent activities by leveraging user-submitted reports to identify and mitigate threats. The new capability will allow […]

The post Microsoft Teams New feature Allows Users to Flag Malicious Calls appeared first on Cyber Security News.

A critical vulnerability has been discovered in Emby Server that allows unauthenticated attackers to gain full administrative access to affected systems. Tracked as CVE-2025-64113 with a severity score of 9.3 out of 10 (CVSS v4), this weakness affects both stable and beta versions of the popular media server software. The vulnerability stems from a weak password recovery […]

The post Critical Emby Server Vulnerability Let Attackers Gain Admin Access appeared first on Cyber Security News.

PortSwigger has enhanced Burp Suite’s scanning arsenal with the latest update to its ActiveScan++ extension, introducing detection for the critical React2Shell vulnerabilities (CVE-2025-55182 and CVE-2025-66478). This server-side request forgery (SSRF) flaw in React applications allows attackers to execute arbitrary shell commands, potentially leading to full remote code execution (RCE) on affected servers. Security researchers and […]

The post Burp Suite’s Scanning Arsenal Powered With Detection for Critical React2Shell Vulnerabilities appeared first on Cyber Security News.

The Indian government is currently evaluating a controversial proposal from the telecom industry that would mandate smartphone manufacturers to enable “always-on” satellite location tracking. This move has sparked significant opposition from major technology companies, including Apple, Google, and Samsung, who argue it poses serious privacy and security risks. The proposal was put forward by the […]

The post Apple, Google and Samsung May Enable Always-On GPS in India appeared first on Cyber Security News.

A deceptive Android application lurking in the Google Play Store, disguised as a document reader and file manager, but delivering the Anatsa banking trojan to users. Cybersecurity firm Zscaler ThreatLabz found an app named “Document Reader – File Manager” by developer ISTOQMAH. The app has amassed over 50,000 downloads while remaining live, tricking users into […]

The post Malicious Document Reader App in Google Play With 50K Downloads Installs Anatsa Malware appeared first on Cyber Security News.

A critical persistence technique in AWS Identity and Access Management (IAM) stemming from its eventual consistency model, allowing attackers to retain access even after defenders delete compromised access keys. AWS IAM, like many distributed systems, employs eventual consistency to scale across regions and replicas. Updates to resources such as access keys or policies propagate with […]

The post Hackers Exploit AWS IAM Eventual Consistency to Establish Persistence appeared first on Cyber Security News.

A sophisticated new phishing kit called GhostFrame has already been used to launch over 1 million attacks. First discovered in September 2025 by Security researchers at Barracuda, this stealthy tool represents a dangerous evolution in phishing-as-a-service technology. What makes GhostFrame particularly concerning is its simplicity combined with effectiveness. Unlike traditional phishing kits, GhostFrame uses an […]

The post New GhostFrame Super Stealthy Phishing Kit Attacks Millions of Users Worldwide appeared first on Cyber Security News.

Cary, North Carolina, USA, December 4th, 2025, CyberNewsWire Cybersecurity and IT training platform maintains Leader and Momentum Leader positions while expanding regional excellence INE has been recognized with seven G2 Winter 2026 badges, underscoring its continued leadership in online course delivery, technical skills development, and cybersecurity education. This season’s awards include Leader status in the […]

The post INE Earns G2 Winter 2026 Badges Across Global Markets appeared first on Cyber Security News.

A new alert warns people about a growing scam that uses altered photos to trick families into paying fake ransom demands. In a notice titled Alert Number: I-120525-PSA, dated December 5, 2025. The FBI explains that criminals are taking photos from social media and other public sites and altering them. Then, they are used as […]

The post FBI Warns of Hackers Altering Photos Found on Social Media to Use as Fake Proof appeared first on Cyber Security News.

QuasarRAT, initially surfacing in 2014 under the alias xRAT, began its lifecycle as a legitimate remote administration tool for Windows environments. Over the last decade, however, its open-source nature and accessibility have facilitated its transformation into a potent instrument for cybercriminals. The malware is built on the .NET Framework using C#, making it highly adaptable […]

The post QuasarRAT Core Functionalities Along with Encrypted Configuration and Obfuscation Techniques Exposed appeared first on Cyber Security News.

As artificial intelligence systems become more autonomous, their ability to interact with digital tools and data introduces complex new risks. Recognizing this challenge, researchers from NVIDIA and Lakera AI have collaborated on a new paper proposing a unified framework for the safety and security of these advanced “agentic” systems. The proposal addresses the shortcomings of […]

The post NVIDIA and Lakera AI Propose Unified Framework for Agentic System Safety appeared first on Cyber Security News.

Security researchers have exposed a critical privacy flaw dubbed “Careless Whisper” that lets attackers monitor user activity on WhatsApp and Signal through silent delivery receipts, without alerting victims or needing prior contact. By crafting stealthy messages like reactions to nonexistent content or timed-out edits, adversaries trigger round-trip time (RTT) responses revealing device states, all exploitable […]

The post Hackers Can Leverage Delivery Receipts on WhatsApp and Signal to Extract User Private Information appeared first on Cyber Security News.

Mobile security continues to face significant challenges as sophisticated malware campaigns evolve to bypass traditional defenses. The Triada Trojan, a persistent threat to Android users for nearly a decade, has resurfaced with a highly coordinated operation targeting advertising networks. This latest campaign leverages trusted infrastructure to distribute malicious payloads, complicating detection efforts. By embedding itself […]

The post Hackers Leverage Multiple Ad Networks to Attack Adroid Users With Triada Malware appeared first on Cyber Security News.

A critical vulnerability affecting Meta React Server Components has been added to the Known Exploited Vulnerabilities catalog, signalling widespread active exploitation by CISA. Tracked as CVE-2025-55182, this remote code execution vulnerability poses an immediate threat to organizations that rely on React Server Components. The vulnerability stems from a significant flaw in how React Server Components […]

The post CISA Adds Critical React2Shell Vulnerability to KEV Catalog Following Active Exploitation appeared first on Cyber Security News.