Aggregator

HackerNews 编译，转载请注明出处： 美国新泽西州最大的县之一正遭受网络攻击，全县政府部门电话线路与 IT 系统均受影响中断。 位于新泽西州北部、人口近 60 万的帕塞伊克县（Passaic County）于周三晚间发布公告，告知居民该县遭遇恶意软件攻击，IT 系统与电话线路受影响。 该县表示：“我们正与联邦及州政府官员合作，调查并控制此次事件。” 该县周三上午首次通报电话线路中断，下午确认故障由网络攻击导致。 在 2023 至 2025 年针对大型都会区的多起勒索软件攻击后，网络犯罪团伙现已将目标转向中小型地方政府。2026 年至今，已有数十个县市成为攻击目标，包括佛罗里达州、康涅狄格州和西弗吉尼亚州的多个城市。 除地方政府外，近几周多家医院也成为黑客攻击目标。密西西比州一家大型医院遭勒索软件攻击后，经过数周恢复，终于在周一恢复正常运营；此前该院系统长期中断、停诊并取消大量预约。 帕塞伊克县官员表示：“新泽西州其他多个地方政府也遭遇过类似事件”，这很可能指此前曾遭勒索软件攻击的萨默塞特县、卡姆登县、伯根县、蒙特克莱尔镇和霍博肯市。   消息来源：therecord.media； 本文由 HackerNews.cc 翻译整理，封面来源于网络； 转载请注明“转自 HackerNews.cc”并附上原文

HackerNews 编译，转载请注明出处： 一个疑似与伊朗相关的威胁组织，通过冒充伊拉克外交部，针对伊拉克政府官员发动攻击并投放多款全新恶意软件。 Zscaler ThreatLabz 于 2026 年 1 月监测到该活动，并将其命名为 Dust Specter 进行追踪。攻击通过两条不同的感染链展开，最终投放 SPLITDROP、TWINTASK、TWINTALK 和 GHOSTFORM 恶意软件。 安全研究员 Sudeep Singh 表示：“Dust Specter 使用随机生成的 URI 路径与 C2 服务器通信，并在路径后附加校验值，确保请求来自真实受感染系统。C2 服务器还使用了地理围栏与 User‑Agent 校验。” 此次攻击的一个显著特点是：攻击者攻陷伊拉克政府相关基础设施，用于投放恶意载荷，同时还使用规避技术延迟执行，以躲避检测。 第一条攻击链以加密 RAR 压缩包开始，其中包含名为 SPLITDROP 的 .NET 加载器，它负责加载工作模块 TWINTASK 与 C2 协调模块 TWINTALK。 TWINTASK 是恶意 DLL（libvlc.dll），通过合法 vlc.exe 进行 DLL 侧加载。它每 15 秒轮询 C:\ProgramData\PolGuid\in.txt 获取新指令，并通过 PowerShell 执行，还包含通过修改注册表实现持久化的指令。脚本输出与错误信息记录在 out.txt 中。 TWINTASK 首次运行时会执行压缩包内合法程序 WingetUI.exe，使其侧加载 TWINTALK 的 DLL（hostfxr.dll）。其主要功能是与 C2 通信获取指令、与 TWINTASK 协同，并回传执行结果。支持将 C2 指令写入 in.txt，并支持文件上传与下载。 Singh 表示：“C2 协调模块与工作模块并行运行，通过文件轮询机制执行指令。TWINTALK 运行后进入心跳循环，随机延迟后再轮询 C2 获取指令。” 第二条攻击链是第一条的升级版，将 TWINTASK 与 TWINTALK 全部功能整合为单一程序 GHOSTFORM。它使用内存中直接执行 PowerShell 的方式运行来自 C2 的指令，从而避免在磁盘上留下痕迹。 这并非两条攻击链的唯一区别。部分 GHOSTFORM 样本内置硬编码 Google 表单地址，运行后会自动用默认浏览器打开。表单为阿拉伯语内容，伪装成伊拉克外交部官方调查问卷。 Zscaler 对 TWINTALK 与 GHOSTFORM 源码分析发现，其中存在占位符、表情符号与 Unicode 文本，表明攻击者可能使用生成式 AI辅助开发恶意软件。 此外，与 TWINTALK 关联的 C2 域名 meetingapp[.]site，已被 Dust Specter 在 2025 年 7 月攻击中用于搭建伪造的 Webex 会议邀请页面，诱导用户复制粘贴并运行 PowerShell 脚本 “加入会议”。该手法与 ClickFix 式社会工程攻击高度一致。 该 PowerShell 脚本会创建目录，从同一域名下载载荷并保存为可执行文件，同时创建计划任务每两小时运行该恶意程序。 Dust Specter 与伊朗关联的依据是：伊朗黑客组织长期使用轻量级自定义 .NET 后门。攻陷伊拉克政府基础设施的手法，也与 OilRig（APT34）等伊朗系组织过往攻击一致。 Zscaler 表示：“本次活动中高置信度归属 Dust Specter，通过高度仿真的社会工程诱饵冒充伊拉克外交部攻击政府官员。该活动也反映出主流趋势：ClickFix 式攻击手法与生成式 AI 在恶意软件开发中的广泛使用。”   消息来源：thehackernews.com； 本文由 HackerNews.cc 翻译整理，封面来源于网络； 转载请注明“转自 HackerNews.cc”并附上原文

在快速扩张的开源生态背景下，安全治理机制往往滞后于功能演进节奏，导致阶段性风险集中暴露。因此，有必要对 OpenClaw 当前的安全现状与公开安全事件进行系统性梳理与客观分析。

Researchers at Check Point have disclosed that since the eruption of hostilities on February 28th, a coalition of

The post Digital Reconnaissance: Iran-Aligned Hackers Hijack Middle Eastern Surveillance Grids Ahead of Kinetic Strikes appeared first on Penetration Testing Tools.

A vulnerability described as problematic has been identified in SEPPmail Secure Email Gateway up to 15.0.0. The impacted element is an unknown function of the component PGP Message Handler. The manipulation results in information disclosure. This vulnerability is identified as CVE-2026-2747. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is recommended.

A vulnerability was found in SEPPmail Secure Email Gateway up to 15.0.0. It has been classified as problematic. This vulnerability affects unknown code of the component PGP Signature Handler. This manipulation causes improper verification of cryptographic signature. This vulnerability appears as CVE-2026-27445. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is recommended.

A vulnerability was found in SEPPmail Secure Email Gateway up to 15.0.0. It has been declared as critical. This issue affects some unknown processing of the component SMIME Handler. Such manipulation leads to improper certificate validation. This vulnerability is traded as CVE-2026-2748. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability labeled as problematic has been found in SEPPmail Secure Email Gateway up to 15.0.0. This affects an unknown function of the component PGP Handler. The manipulation results in improper verification of cryptographic signature. This vulnerability was named CVE-2026-2746. The attack may be performed from remote. There is no available exploit. The affected component should be upgraded.

A vulnerability was found in Nozomi Arc up to 2.1.x. It has been rated as critical. This affects an unknown function. The manipulation leads to improper certificate validation. This vulnerability is traded as CVE-2025-40896. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is advised.

A vulnerability categorized as problematic has been discovered in Nozomi Guardian and CMC up to 25.5.x. This impacts an unknown function of the component Alerted Nodes Dashboard. The manipulation results in cross site scripting. This vulnerability is known as CVE-2025-40894. It is possible to launch the attack remotely. No exploit is available. It is advisable to upgrade the affected component.

A vulnerability has been found in SUSE Rancher up to 6.0.2/7.0.4/8.1.1/9.0.0 and classified as problematic. Affected is an unknown function. The manipulation leads to sensitive information in log files. This vulnerability is listed as CVE-2025-62879. The attack may be initiated remotely. There is no available exploit. The affected component should be upgraded.

A vulnerability was found in 2N Telekomunikace 2N Access Commander up to 3.4.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the component API Endpoint. The manipulation results in os command injection. This vulnerability is cataloged as CVE-2025-59783. The attack may be launched remotely. There is no exploit available. It is suggested to upgrade the affected component.

A vulnerability was found in 2N Telekomunikace 2N Access Commander up to 3.4. It has been declared as problematic. This affects an unknown part of the component Password Policy Handler. Such manipulation leads to improper validation of syntactic correctness of input. This vulnerability is documented as CVE-2025-59785. The attack can be executed remotely. There is not any exploit available. It is recommended to upgrade the affected component.

A vulnerability identified as problematic has been detected in 2N Telekomunikace 2N Access Commander up to 3.4. Impacted is an unknown function. The manipulation leads to improper check or handling of exceptional conditions. This vulnerability is traded as CVE-2025-59787. It is possible to initiate the attack remotely. There is no exploit available. You should upgrade the affected component.

A vulnerability, which was classified as problematic, has been found in 2N Telekomunikace 2N Access Commander up to 3.4. Affected by this vulnerability is an unknown functionality. The manipulation leads to session expiration. This vulnerability is referenced as CVE-2025-59786. Remote exploitation of the attack is possible. No exploit is available. It is advisable to upgrade the affected component.

A vulnerability identified as problematic has been detected in Checkmk up to 2.2.0/2.3.0p42/2.4.0p22. Affected is the function remove_password. This manipulation causes incorrect authorization. This vulnerability is handled as CVE-2026-3103. The attack can be initiated remotely. There is not any exploit available. You should upgrade the affected component.

A vulnerability was found in 2N Telekomunikace 2N Access Commander up to 3.4.1. It has been classified as problematic. Affected by this issue is some unknown functionality. This manipulation causes improper output neutralization for logs. This vulnerability is registered as CVE-2025-59784. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is recommended.

伊朗针对IP摄像头的攻击，竟与中东实体作战深度关联。