Aggregator

Falco is an open-source runtime security tool for Linux systems, built for cloud-native environments. It monitors the system in real time to spot unusual activity and possible security threats. Falco is a graduated project from the Cloud Native Computing Foundation (CNCF) and is used in production by many organizations. The tool works by watching system events such as syscalls, using custom rules. It can also add context from container runtimes and Kubernetes. The events it … More →

The post Falco: Open-source cloud-native runtime security tool for Linux appeared first on Help Net Security.

North Korean threat actors have escalated their software supply chain attacks with the deployment of 67 malicious npm packages that collectively garnered over 17,000 downloads before detection. This latest campaign represents a significant expansion of the ongoing “Contagious Interview” operation, introducing a previously unreported malware loader dubbed XORIndex alongside the existing HexEval Loader infrastructure. The […]

The post North Korean Hackers Weaponized 67 Malicious npm Packages to Deliver XORIndex Malware appeared first on Cyber Security News.

A massive network of fraudulent news websites has been uncovered, with cybersecurity researchers identifying over 17,000 Baiting News Sites (BNS) across 50 countries orchestrating sophisticated investment fraud schemes. These malicious platforms masquerade as legitimate news outlets, publishing fabricated stories featuring well-known public figures and respected financial institutions to build trust and lure unsuspecting victims into […]

The post BaitTrap – 17,000+ Fake News Websites Caught Promoting Investment Frauds appeared first on Cyber Security News.

A new report from Living Security and the Cyentia Institute sheds light on the real human element behind cybersecurity threats, and it’s not what most organizations expect. The Risky Business: Who Protects & Who Puts You at Risk report analyzes data from over 100 organizations and challenges conventional thinking by revealing that a small portion of users, just 10 percent, are responsible for nearly 73 percent of all risky behavior in the enterprise. “The riskiest … More →

The post Most cybersecurity risk comes from just 10% of employees appeared first on Help Net Security.

据网络安全公司ReliaQuest称，NetScaler ADC和网关的一个关键漏洞“Citrix Bleed 2”（CVE-2025-5777）现在很可能被利用在攻击中，Citrix设备上的可疑会话有所增加。

Citrix Bleed 2，由网络安全研究员Kevin Beaumont命名，因为它与最初的Citrix Bleed （CVE-2023-4966）相似，是一个内存读取漏洞，允许未经身份验证的攻击者访问通常不可访问的内存部分。

这可能允许攻击者从面向公众的网关和虚拟服务器窃取会话令牌、凭据和其他敏感数据，使他们能够劫持用户会话并绕过多因素身份验证（MFA）。

Citrix的顾问也确认了这一风险，提醒用户安装安全更新以阻止访问任何被劫持的会话后，结束所有ICA和PCoIP会话。

该漏洞被追踪为CVE-2025-5777，Citrix于2025年6月17日解决了该漏洞，没有任何活跃利用的报告。然而，Beaumont警告说上周存在被利用的可能性较高。

研究人员的担忧似乎是有根据的，因为ReliaQuest表示，CVE-2025-5777已经被用于有针对性的攻击。

虽然没有公开利用CVE-2025-5777（被称为“Citrix Bleed 2”）的报道，但ReliaQuest认为，攻击者正在积极利用这一漏洞，获得对目标环境的初始访问权限。

这一结论是基于对最近实际攻击的以下观察得出的：

·被劫持的Citrix web会话在没有用户交互的情况下被授予身份验证，这表明攻击者使用被盗的会话令牌绕过了MFA。

·攻击者在合法和可疑的IP地址上重复使用相同的Citrix会话，这表明会话劫持和从未经授权的来源重播。

·LDAP查询是在访问后发起的，这表明攻击者执行了Active Directory侦察来映射用户、组和权限。

·adeexplorer64 .exe的多个实例跨系统运行，表明协调的域侦察和对各种域控制器的连接尝试。

·Citrix会话起源于与消费者VPN提供商（如DataCamp）相关的数据中心ip，这表明攻击者通过匿名基础设施进行混淆。

上述情况与未经授权访问Citrix后的开发活动一致，强化了CVE-2025-5777正在被利用的评估。

为了防止这种活动，可能受到影响的用户应该升级到14.1-43.56+、13.1-58.32+或13.1-FIPS/NDcPP 13.1-37.235+版本来修复漏洞。

在安装最新固件后，管理员应该终止所有活动的ICA和PCoIP会话，因为它们可能已经被劫持了。

在终止活动会话之前，管理员应该首先使用show icconnection命令和NetScaler Gateway > PCoIP > Connections检查它们是否存在可疑活动。在检查活动会话后，管理员可以使用以下命令终止它们：终止所有连接、终止pcoipconnection -all。如果无法立即安装安全更新，建议通过网络acl或防火墙规则限制外部对NetScaler的访问。

在被问到关于CVE-2025-5777是否被积极利用的问题时，Citrix表示没有发现任何利用的迹象。然而，另一个Citrix漏洞，跟踪为CVE-2025-6543，正在攻击中被利用，导致NetScaler设备上的拒绝服务条件。Citrix表示，这个漏洞和CVE-2025-5777漏洞在同一个模块中，但是不同的漏洞。

The United Kingdom’s National Cyber Security Centre (NCSC) has unveiled a new program titled the Vulnerability Research Initiative (VRI), aimed at deepening collaboration with independent experts in vulnerability discovery. This initiative seeks to bolster...

The post NCSC Launches Initiative to Boost UK Cyber Defenses with External Experts appeared first on Penetration Testing Tools.

The Central Bureau of Investigation (CBI) of India has announced the dismantling of a transnational cybercriminal syndicate responsible for large-scale tech support scams. The operation, codenamed Chakra V, was carried out on July 7,...

The post Global Scam Ring SHUT DOWN: CBI Nabs Tech Support Fraudsters appeared first on Penetration Testing Tools.