Found 847 bookmarks
Custom sorting
UK watchdog fines 23andMe over 2023 data breach
UK watchdog fines 23andMe over 2023 data breach
The ICO said over 150,000 U.K. residents had data stolen in the breach. The U.K. data protection watchdog has fined 23andMe £2.31 million ($3.1 million) for failing to protect U.K. residents’ personal and genetic data prior to its 2023 data breach. The Information Commissioner’s Office (ICO) said on Tuesday it has fined the genetic testing company as it “did not have additional verification steps for users to access and download their raw genetic data” at the time of its cyberattack. In 2023, hackers stole private data on more than 6.9 million users over a months-long campaign by accessing thousands of accounts using stolen credentials. 23andMe did not require its users to use multi-factor authentication, which the ICO said broke U.K. data protection law. The ICO said over 155,000 U.K. residents had their data stolen in the breach. In response to the fine, 23andMe told TechCrunch that it had rolled out mandatory multi-factor authentication for all accounts. The ICO said it is in contact with 23andMe’s trustee following the company’s filing for bankruptcy protection. A hearing on 23andMe’s sale is expected later on Wednesday.
·techcrunch.com·
UK watchdog fines 23andMe over 2023 data breach
Iran's state TV hacked, protest videos aired | Iran International
Iran's state TV hacked, protest videos aired | Iran International
Jun 18, 2025, 19:09 GMT+1 Iran’s state broadcaster was hacked Wednesday night, with videos calling for street protests briefly aired. Footage circulated on social media showed protest-themed clips interrupting regular programming. "If you experience disruptions or irrelevant messages while watching various TV channels, it is due to enemy interference with satellite signals," state TV said. The hacking of the programming on Wednesday night was limited to satellite transmissions, the Islamic Republic of Iran Broadcasting (IRIB) said.
·iranintl.com·
Iran's state TV hacked, protest videos aired | Iran International
UBS Employee Data Reportedly Exposed in Third Party Attack
UBS Employee Data Reportedly Exposed in Third Party Attack
Global banking giant UBS has suffered a data breach following a cyber-attack on a third-party supplier. In a statement emailed to Infosecurity, a UBS spokesperson confirmed a breach had occurred, but it had not impacted customer data or operations. “A cyber-attack at an external supplier has led to information about UBS and several other companies being stolen. No client data has been affected. As soon as UBS became aware of the incident, it took swift and decisive action to avoid any impact on its operations,” the UBS statement read. Swiss-based newspaper Le Temps reported that information about 130,000 UBS employees had been published on the dark web by a ransomware group called World Leaks, previously known as Hunters International, following the incident. This data includes business contact details, including phone number, their job role and details of their location and floor they work on. The direct phone number of UBS CEO Sergio Ermotti was reportedly included in the published data. UBS also confirmed to Infosecurity that the external supplier at the center of the incident was procurement service provider Swiss-based Chain IQ. Another Chain IQ client, Swiss private bank Pictet, also revealed it had suffered a data breach as a result of the attack. Pictet said in statement published by Reuters that the information stolen did not contain its client data and was limited to invoice information with some of the bank's suppliers, such as technology providers and external consultants. At the time of writing, it is not known whether any other Chain IQ customers have been impacted.
·infosecurity-magazine.com·
UBS Employee Data Reportedly Exposed in Third Party Attack
No, the 16 billion credentials leak is not a new data breach
No, the 16 billion credentials leak is not a new data breach
News broke today about "one of the largest data breaches in history," sparking wide media coverage filled with warnings and fear-mongering. However, it appears to just be a compilation of previously leaked credentials stolen by infostealers, exposed in data breaches, and via credential stuffing attacks. To be clear, this is not a new data breach, or a breach at all, and the websites involved were not recently compromised to steal these credentials. Instead, these stolen credentials were likely circulating for some time, if not for years. It was then collected by a cybersecurity firm, researchers, or threat actors and repackaged into a database that was exposed on the Internet. Cybernews, which discovered the briefly exposed datasets of compiled credentials, stated it was stored in a format commonly associated with infostealer malware, though they did not share samples An infostealer is malware that attempts to steal credentials, cryptocurrency wallets, and other data from an infected device. Over the years, infostealers have become a massive problem, leading to breaches worldwide. ... The infostealer problem has gotten so bad and pervasive that compromised credentials have become one of the most common ways for threat actors to breach networks.
·bleepingcomputer.com·
No, the 16 billion credentials leak is not a new data breach
CoinMarketCap Briefly Exploited With Wallet Phishing Pop-Up Message
CoinMarketCap Briefly Exploited With Wallet Phishing Pop-Up Message
The company has not disclosed how many users were affected or whether any wallets were compromised as a result of the exploit. Hackers exploited a vulnerability in CoinMarketCap's front-end system by using a doodle image to inject malicious code. The code triggered fake wallet verification pop-ups across the site, instructing users to "Verify Wallet" in a phishing tactic to gain access to their crypto holdings. * CoinMarketCap's team removed the pop-up shortly after discovery and has implemented measures to isolate and mitigate the issue. Hackers exploited a vulnerability in CoinMarketCap’s front-end system, using a seemingly harmless doodle image to inject malicious code that triggered fake wallet verification pop-ups across the site. The breach, confirmed by CoinMarketCap, used its backend API to deliver a manipulated JSON payload that embedded JavaScript into the homepage according to blockchain security firm Coinspect Security.
·coindesk.com·
CoinMarketCap Briefly Exploited With Wallet Phishing Pop-Up Message
‘States don’t do hacking for fun’: NCSC expert urges businesses to follow geopolitics as defensive strategy
‘States don’t do hacking for fun’: NCSC expert urges businesses to follow geopolitics as defensive strategy
Business leaders need to stay up to date with geopolitics to keep their cybersecurity strategies up to date and mitigate the risks posed by state-backed hacker groups. This is the message that Paul Chichester, director of operations at the UK’s National Cyber Security Centre (NCSC), delivered to attendees at a keynote session of Infosecurity Europe 2025. The call to action from Chichester came as states known to support threat actors and engage in cyber attacks of their own step up efforts to disrupt critical infrastructure Chichester said Russia’s cyber capabilities in particular have improved in recent years, with its invasion of Ukraine used as an opportunity to hone offensive cyber techniques. Along with Russia, Chichester focused on the threat China-backed groups pose to both public and private organizations. “I'll come back to this a few times, but states don't do hacking for fun,” Chichester said. “They do not do things for the sake of it. There is always a reason. We might not know the reason sometimes and that's quite a challenge for us, but we shouldn't assume that they're just doing it because they can.” Chichester urged businesses who are being targeted by a state APT to carefully consider why and to assess how geopolitics feeds into their defensive strategies.
·itpro.com·
‘States don’t do hacking for fun’: NCSC expert urges businesses to follow geopolitics as defensive strategy
CVE-2025-49763 - Remote DoS via Memory Exhaustion in Apache Traffic Server via ESI Plugin
CVE-2025-49763 - Remote DoS via Memory Exhaustion in Apache Traffic Server via ESI Plugin
Imperva’s Offensive Security Team discovered CVE-2025-49763, a high-severity vulnerability (CVSS v3.1 estimated score: 7.5) in Apache Traffic Server’s ESI plugin that enables unauthenticated attackers to exhaust memory and potentially crash proxy nodes. Given ATS’s role in global content delivery[1], even a single node failure can black-hole thousands of sessions. Organizations should urgently upgrade to version 9.2.11 or 10.0.6 and enforce the new inclusion-depth safeguard. Why reverse‑proxy servers matter Every web request you make today almost certainly travels through one or more reverse‑proxy caches before it reaches the origin application. These proxies: Off‑load origin servers by caching hot objects Collapse duplicate requests during traffic spikes Terminate TLS and enforce security controls And sit “at the edge”, close to end‑users, to shave hundreds of milliseconds off page‑load time. Because they concentrate so much traffic, a single reverse‑proxy node going offline can black‑hole thousands of concurrent sessions; at scale, an outage ripples outward like a dropped stone in water, slowing CDNs, SaaS platforms, media portals and on‑line banks alike. Denial‑of‑service (DoS) conditions on these boxes are therefore high‑impact events, not a mere nuisance. ... CVE-2025-49763 is a newly disclosed flaw in Apache Traffic Server’s Edge-Side Includes plugin that allows an unauthenticated attacker to embed or request endlessly nested %3Cesi:include%3E tags, forcing the proxy to consume all available memory until it is out-of-memory-killed and service is lost. This vulnerability can be exploited via two different ways: A threat actor could exploit an Edge Side Include injection and recursively inject the same page over and over again. exploitation via esi injection A threat actor could also host a malicious server next to a target, behind a vulnerable traffic server proxy and take down the proxy by triggering the ESI request avalanche. (see Fig 2). exploitation via malicious error This results in a full denial of service on edge proxy nodes, triggered remotely without requiring authentication.
·imperva.com·
CVE-2025-49763 - Remote DoS via Memory Exhaustion in Apache Traffic Server via ESI Plugin
Record DDoS pummels site with once-unimaginable 7.3Tbps of junk traffic
Record DDoS pummels site with once-unimaginable 7.3Tbps of junk traffic
Attacker rained down the equivalent of 9,300 full-length HD movies in just 45 seconds. Large-scale attacks designed to bring down Internet services by sending them more traffic than they can process keep getting bigger, with the largest one yet, measured at 7.3 terabits per second, being reported Friday by Internet security and performance provider Cloudflare. The 7.3Tbps attack amounted to 37.4 terabytes of junk traffic that hit the target in just 45 seconds. That's an almost incomprehensible amount of data, equivalent to more than 9,300 full-length HD movies or 7,500 hours of HD streaming content in well under a minute. Indiscriminate target bombing Cloudflare said the attackers “carpet bombed” an average of nearly 22,000 destination ports of a single IP address belonging to the target, identified only as a Cloudflare customer. A total of 34,500 ports were targeted, indicating the thoroughness and well-engineered nature of the attack. The vast majority of the attack was delivered in the form of User Datagram Protocol packets. Legitimate UDP-based transmissions are used in especially time-sensitive communications, such as those for video playback, gaming applications, and DNS lookups. It speeds up communications by not formally establishing a connection before data is transferred. Unlike the more common Transmission Control Protocol, UDP doesn't wait for a connection between two computers to be established through a handshake and doesn't check whether data is properly received by the other party. Instead, it immediately sends data from one machine to another.
·arstechnica.com·
Record DDoS pummels site with once-unimaginable 7.3Tbps of junk traffic
Iran's government says it shut down internet to protect against cyberattacks
Iran's government says it shut down internet to protect against cyberattacks
The government cited the recent hacks on Bank Sepah and cryptocurrency exchange Nobite as reasons to shut down internet access to virtually all Iranians. Earlier this week, virtually everyone in Iran lost access to the internet in what was called a “near-total national internet blackout.” At the time, it was unclear what happened or who was responsible for the shutdown, which has severely limited Iranians’ means to get information about the ongoing war with Israel, as well as their ability to communicate with loved ones inside and outside of the country. Now Iran’s government has confirmed that it ordered the shutdown to protect against Israeli cyberattacks. “We have previously stated that if necessary, we will certainly switch to a national internet and restrict global internet access. Security is our main concern, and we are witnessing cyberattacks on the country’s critical infrastructure and disruptions in the functioning of banks,” Fatemeh Mohajerani, Iran’s government spokesperson, was quoted as saying in a local news story. “Many of the enemy’s drones are managed and controlled via the internet, and a large amount of information is exchanged this way. A cryptocurrency exchange was also hacked, and considering all these issues, we have decided to impose internet restrictions.”
·techcrunch.com·
Iran's government says it shut down internet to protect against cyberattacks
Health ministry’s information system hit by ransomware attack – TALANOA 'O TONGA
Health ministry’s information system hit by ransomware attack – TALANOA 'O TONGA
Tonga’s National Health Information System (NHIS) suffered a ransomware breach this week, says Dr ʻAna ʻAkauʻola his evening. The system has been shut down, and staff moved to manual operations. The breach came to light during a parliament debate on the MEIDECC budget, when Deputy PM Dr Taniela Fusimalohi alerted MPs to the intrusion. Dr ʻAkauʻola confirmed she learned of the hack earlier this week and immediately summoned system administrators. She noted that staff member managing the NHIS “was unaware that it was a serious breach.” The minister disclosed that hackers encrypted the NHIS and demanded payment, assuring MPs “the hackers won’t damage the information on the NHIS.” She also said she promptly emailed Dr Fusimalohi when she knew of the breach, who engaged the Australian High Commission. Dr Fusimalohi confirmed an Australian cyber team arrived in Tonga today to help resolve the issue.
·talanoaotonga.to·
Health ministry’s information system hit by ransomware attack – TALANOA 'O TONGA
India's TCS says none of its systems were compromised in M&S hack | Reuters
India's TCS says none of its systems were compromised in M&S hack | Reuters
June 19 (Reuters) - Tata Consultancy Services (TCS.NS), opens new tab said none of its "systems or users were compromised" as part of the cyberattack that led to the theft of customer data at retailer Marks and Spencer (MKS.L), opens new tab, its client of more than a decade. "As no TCS systems or users were compromised, none of our other customers are impacted" independent director Keki Mistry told its annual shareholder meeting. The Reuters Daily Briefing newsletter provides all the news you need to start your day. Sign up here. "The purview of the investigation (of customer) does not include TCS," Mistry added. This is the first time India's No 1 IT services company has publicly commented on the cyber hack. M&S did not immediately respond to a request for comment. TCS is one of the technology services providers for the British retailer. In early 2023, TCS reportedly, opens new tab won a $1 billion contract for modernising M&S' legacy technology with respect to its supply chain and omni-channel sales while increasing its online sales. The "highly sophisticated and targeted" cyberattack which M&S disclosed in April will cost about 300 million pounds ($403 million) in lost operating profit, and disruption to online services is likely until July. Last month, Financial Times reported that TCS is internally investigating whether it was the gateway for a cyberattack. Mistry presided as the chairman at the company's annual shareholder meeting as Tata Group Chairman N Chandrasekaran skipped it due to "exigencies". The chairman's absence comes as the Group's airline Air India plane with 242 people on board crashed after take-off in Ahmedabad last week, killing all passengers except one. Reporting by Sai Ishwarbharath B and Haripriya Suresh, Editing by Louise Heavens
·reuters.com·
India's TCS says none of its systems were compromised in M&S hack | Reuters
Analyzing SERPENTINE#CLOUD: Threat Actors Abuse Cloudflare Tunnels to Infect Systems with Stealthy Python-Based Malware - Securonix
Analyzing SERPENTINE#CLOUD: Threat Actors Abuse Cloudflare Tunnels to Infect Systems with Stealthy Python-Based Malware - Securonix
Securonix Threat Research uncovers SERPENTINE#CLOUD, a stealthy malware campaign abusing Cloudflare Tunnels to deliver in-memory Python-based payloads via .lnk phishing lures. Learn how this multi-stage attack evades detection, establishes persistence, and executes Donut-packed shellcode using Early Bird APC injection. An ongoing malware campaign tracked as SERPENTINE#CLOUD has been identified as leveraging the Cloudflare Tunnel infrastructure and Python-based loaders to deliver memory-injected payloads through a chain of shortcut files and obfuscated scripts. For initial access, the threat actors are luring users to execute malicious .lnk files (shortcut files) disguised as documents to silently fetch and execute remote code. This kicks off a rather elaborate attack chain consisting of a combination of batch, VBScript and Python stages to ultimately deploy shellcode that loads a Donut-packed PE payload. The shortcut files are delivered via phishing emails that contain a link to download a zipped document, often themed around payment or invoice scams. This assessment is based on the naming convention of the ZIP files observed, many of which included the word “invoice.” Attribution remains unknown, though the attacker demonstrates fluency in English based on code comments and scripting practices. Telemetry indicates a strong focus on Western targets, with confirmed activity observed in the United States, United Kingdom, Germany and other regions across Europe and Asia. The use of Cloudflare for payload hosting allows the attackers to remain anonymous and since their infrastructure is secured behind a trusted network, monitored traffic to this network will rarely raise alarms or be flagged as suspicious by network monitoring tools.
·securonix.com·
Analyzing SERPENTINE#CLOUD: Threat Actors Abuse Cloudflare Tunnels to Infect Systems with Stealthy Python-Based Malware - Securonix
Kremlin-affiliated outlets find digital ally in Colombia's oldest guerrilla group
Kremlin-affiliated outlets find digital ally in Colombia's oldest guerrilla group
US-designated terrorist organization ELN oversees a vast digital operation that promotes pro-Kremlin and anti-US content. The National Liberation Army (ELN), a Colombian armed group that also holds influence in Venezuela, has built a digital strategy that involves branding themselves as media outlets to build credibility, overseeing a diffuse cross-platform operation, and using these wide-ranging digital assets to amplify Russian, Iranian, Venezuelan, and Cuban narratives that attack the interests of the United States, the European Union (EU), and their allies. In the 1960s, the ELN emerged as a Colombian nationalist armed movement ideologically rooted in Marxism-Leninism, liberation theology, and the Cuban revolution. With an army estimated to have 2,500 to 6,000 members, the ELN is Colombia’s oldest and largest active guerrilla group, with its operation extending into Venezuela. The ELN has maintained a strategic online presence for over a decade to advance its propaganda and maintain operational legitimacy. The organization, which has previously engaged in peace talks with the Colombian state, has carried out criminal activities in Colombia and Venezuela, such as killings, kidnappings, extortions, and the recruitment of minors. After successive military and financial crises in the 1990s, the armed group abandoned its historical reluctance to participate in drug trafficking. The diversification into illegal funding has meant that their armed clashes target criminal groups, in addition to their primary ideological enemy, the state forces. In the north-eastern Catatumbo area, considered one of the enclaves of international cocaine trafficking, the group has been involved in one of the bloodiest confrontations seen in Colombia in 2025. Since January 15, the violence has left 126 people dead, at least 66,000 displaced, and has further strained the group’s engagement with the latest round of peace talks initiated by the current Colombian government. In that region, the ELN has battled with the state and other criminal groups, such as paramilitaries and other guerrilla groups, for extended control of the area bordering Venezuela, an effort to connect the ELN’s other territories of influence to Colombia, such as the north and, at the other extreme, the western regions of Choco and Antioquia. The US Department of State reaffirmed the ELN’s designation as a terrorist organization in its March 5, 2025, update of the Foreign Terrorist Organizations (FTOs) list. This classification theoretically prevents the group from operating on major social media platforms, as US social media platforms, such as Meta, YouTube, and X, maintain policies prohibiting terrorist organizations from using their services. However, the DFRLab found that the group’s substantial digital footprint spans over one hundred entities across websites, social media, closed messaging apps, and podcast services.
·dfrlab.org·
Kremlin-affiliated outlets find digital ally in Colombia's oldest guerrilla group
GreyNoise Observes Exploit Attempts Targeting Zyxel CVE-2023-28771
GreyNoise Observes Exploit Attempts Targeting Zyxel CVE-2023-28771
‍On June 16, GreyNoise observed exploit attempts targeting CVE-2023-28771 — a remote code execution vulnerability affecting Zyxel Internet Key Exchange (IKE) packet decoders over UDP port 500. CVE: CVE-2023-28771 Exploit method: UDP port 500 (IKE packet decoder) Date observed: June 16, 2025 Duration of activity: One day (June 16, 2025) Unique IPs: 244 Top destination countries: U.S., U.K., Spain, Germany, India. IP classification: All malicious per GreyNoise Infrastructure: Verizon Business (all IPs geolocated to U.S.) Spoofable traffic: Yes (UDP-based) ‍ Observed Activity Exploitation attempts against CVE-2023-28771 were minimal throughout recent weeks. On June 16, GreyNoise observed a concentrated burst of exploit attempts within a short time window, with 244 unique IPs observed attempting exploitation. The top destination countries were the U.S., U.K., Spain, Germany, and India. Historical analysis indicates that in the two weeks preceding June 16, these IPs were not observed engaging in any other scanning or exploit behavior — only targeting CVE-2023-28771. ‍
·greynoise.io·
GreyNoise Observes Exploit Attempts Targeting Zyxel CVE-2023-28771
10K Records Allegedly from Mac Cloud Provider’s Customers Exposed Online
10K Records Allegedly from Mac Cloud Provider’s Customers Exposed Online
SafetyDetectives’ Cybersecurity Team stumbled upon a clear web forum post where a threat actor publicized a database that allegedly belongs to VirtualMacOSX.com. The data purportedly belongs to 10,000 of its customers. In a recent discovery, SafetyDetectives’ Cybersecurity Team stumbled upon a clear web forum post where a threat actor publicized a database that allegedly belongs to VirtualMacOSX.com. The data purportedly belongs to 10,000 of its customers. What Is VirtualMacOSX.com? According to its website, VirtualMacOSX serves 102 countries and has offered “Apple Macintosh cloud based computing since 2012. With the greatest range of cloud based Apple products and services available anywhere on the Web.” Where Was The Data Found? The data was found in a forum post available on the clear surface web. This well-known forum operates message boards dedicated to database downloads, leaks, cracks, and more. What Was Leaked? The author of the post included a 34-line sample of the database, the full database was set to be freely accessible to anyone with an account on the forum willing to either reply or like the post. Our Cybersecurity Team analyzed a segment of the dataset to validate its authenticity. Although the data appeared genuine and we saw indicatives in invoices sent to VirtualMacOSX, we could not definitively confirm that the data belonged to VirtualMacOSX’s customers as, due to ethical considerations, we refrained from testing the exposed credentials. The entire dataset consisted of 176,000 lines split across three separate .txt files named ‘tblcontacts,’ ‘tbltickets,’ and ‘tblclients.’ The sensitive information allegedly belonging to VirtualMacOSX’s customers included: User ID Full name Company name Email Full physical address Phone number Password Password reset key We also saw customers’ financial data such as: Bank name Bank type Bank code Bank account And User’s Support tickets containing: User ID IP Address Full name Email Full Message This type of data is critical as it might be employed by potential wrongdoers to plan and perform various types of attacks on the impacted clients.
·safetydetectives.com·
10K Records Allegedly from Mac Cloud Provider’s Customers Exposed Online
Pro-Israel hacktivist group claims responsibility for alleged Iranian bank hack
Pro-Israel hacktivist group claims responsibility for alleged Iranian bank hack
The pro-Israeli hacktivist group Predatory Sparrow claimed on Tuesday to have hacked and taken down Iran’s Bank Sepah. The group, which is also known by its Persian name Gonjeshke Darande, claimed responsibility for the hack on X. “We, ‘Gonjeshke Darande,’ conducted cyberattacks which destroyed the data of the Islamic Revolutionary Guard Corps’ ‘Bank Sepah,’” the group wrote. The group claimed Bank Sepah is an institution that “circumvented international sanctions and used the people of Iran’s money to finance the regime’s terrorist proxies, its ballistic missile program and its military nuclear program.” According to the independent news site Iran International, there are reports of “widespread banking disruptions” across the country. Iran International said several Bank Sepah branches were closed on Tuesday, and customers told the publication that they were unable to access their accounts. Ariel Oseran, a correspondent for i24NEWS, posted pictures of ATMs in Iran displaying an error message. TechCrunch could not independently verify the group’s alleged cyberattack. We reached out to two Bank Sepah Iranian email addresses, but the messages returned an error. Bank Sepah’s affiliates in the U.K. and Italy did not immediately respond to requests for comment. Predatory Sparrow did not respond to a request for comment sent to their X account, and via Telegram. The alleged cyberattack on Bank Sepah comes as Israel and Iran are bombing each other’s countries, a conflict that started after Israel began targeting nuclear energy facilities, military bases, and senior Iranian military officials on Friday. It’s unclear who is behind Predatory Sparrow. The group clearly fashions itself as a pro-Israel or at least anti-Iran hacktivist group and has targeted companies and organizations in Iran for years. Cybersecurity researchers believe the group has had success in the past and made credible claims.
·techcrunch.com·
Pro-Israel hacktivist group claims responsibility for alleged Iranian bank hack
New permission prompt for Local Network Access
New permission prompt for Local Network Access
Learn about the new permission prompt for sites that connect to local networks. Published: June 9, 2025 Chrome is adding a new permission prompt for sites that make connections to a user's local network as part of the draft Local Network Access specification. The aim is to protect users from cross-site request forgery (CSRF) attacks targeting routers and other devices on private networks, and to reduce the ability of sites to use these requests to fingerprint the user's local network. To understand how this change impacts the web ecosystem, the Chrome team is looking for feedback from developers who build web applications that rely on making connections to a user's local network or to software running locally on the user's machine. From Chrome 138, you can opt-in to these new restrictions by going to chrome://flags/#local-network-access-check and setting the flag to "Enabled (Blocking)". Note: Chrome previously experimented with restricting access to local network devices with Private Network Access, which required CORS preflights where the target device opted in to being connected to, instead of gating all local network accesses behind a permission prompt. Local Network Access replaces that effort, after PNA was put on hold. Thank you to everyone who helped test PNA and provide feedback to us—it has been incredibly valuable and helped guide us to our new Local Network Access permission approach. What is Local Network Access? Local Network Access restricts the ability of websites to send requests to servers on a user's local network (including servers running locally on the user's machine), requiring the user grant the site permission before such requests can be made. The ability to request this permission is restricted to secure contexts. A prompt with the text 'Look for and connect to any device on your local network.' Example of Chrome's Local Network Access permission prompt. Many other platforms, such as Android, iOS, and MacOS have a local network access permission. For example, you may have granted this permission to access the local network to the Google Home app when setting up new Google TV and Chromecast devices. What kinds of requests are affected? For the first milestone of Local Network Access, we consider a "local network request" to be any request from the public network to a local network or loopback destination. A local network is any destination that resolves to the private address space defined in Section 3 of RFC1918 in IPv4 (e.g., 192.168.0.0/16), an IPv4-mapped IPv6 address where the mapped IPv4 address is itself private, or an IPv6 address outside the ::1/128, 2000::/3, and ff00::/8 subnets. Loopback is any destination that resolves to the "loopback" space (127.0.0.0/8) defined in section 3.2.1.3 of RFC1122 of IPv4, the "link-local" space (169.254.0.0/16) defined in RFC3927 of IPv4, the "Unique Local Address" prefix (fcc00::/7) defined in Section 3 of RFC4193 of IPv6, or the "link-local" prefix (fe80::/10) defined in section 2.5.6 of RFC4291 of IPv6. A public network is any other destination. Note: In the future, we plan to extend these protections to cover all cross-origins requests going to destinations on the local network. This would include requests from a local server (for example, https://router.local) to other servers on the local network, or from a local server to localhost. Because the local network access permission is restricted to secure contexts, and it can be difficult to migrate local network devices to HTTPS, the permission-gated local network requests will now be exempted from mixed content checks if Chrome knows that the requests will be going to the local network before resolving the destination. Chrome knows a request is going to the local network if: The request hostname is a private IP literal (e.g., 192.168.0.1). The request hostname is a .local domain. The fetch() call is annotated with the option targetAddressSpace: "local". // Example 1: Private IP literal is exempt from mixed content. fetch("http://192.168.0.1/ping"); // Example 2: .local domain is exempt from mixed content. fetch("http://router.local/ping"); // Example 3: Public domain is not exempt from mixed content, // even if it resolves to a local network address. fetch("http://example.com/ping"); // Example 4: Adding the targetAddressSpace option flags that // the request will go to the local network, and is thus exempt // from mixed content. fetch("http://example.com/ping", { targetAddressSpace: "local", }); What's changing in Chrome Chrome 138 Our initial version of Local Network Access is ready for opt-in testing in Chrome 138. Users can enable the new permission prompt by setting chrome://flags#local-network-access-check to "Enabled (Blocking)". This supports triggering the Local Network Access permission prompt for requests initiated using the JavaScript fetch() API, subresource loading, and subframe navigation. A demo site is available at https://local-network-access-testing.glitch.me/ for triggering different forms of local network requests. Known issues and limitations The new permission prompt is currently only implemented on Desktop Chrome. We are actively working on porting it to Android Chrome. (Tracked in crbug.com/400455013.) WebSockets (crbug.com/421156866), WebTransport (crbug.com/421216834), and WebRTC (crbug.com/421223919) connections to the local network are not yet gated on the LNA permission. Local network requests from Service Workers currently require that the service worker's origin has previously been granted the Local Network Access permission. If your application makes local network requests from a service worker, you will currently need to separately trigger a local network request from your application in order to trigger the permission prompt. (We are working on a way for workers to trigger the permission prompt if there is an active document available—see crbug.com/404887282.) Chrome 139 and beyond Our intent is to ship Local Network Access as soon as possible. Recognizing that some sites may need additional time to be updated with Local Network Access annotations, we will add an Origin Trial to let sites temporarily opt-out of the secure contexts requirement before we ship Local Network Access by default. This should provide a clearer migration path for developers, especially if you rely on accessing local network resources over HTTP (as these requests would be blocked as mixed content if requested from an HTTPS page in browsers that don't yet support the Local Network Access mixed content exemption). We will also be adding a Chrome enterprise policy for controlling which sites can and cannot make local network requests (pre-granting or pre-denying the permission to those sites). This will allow managed Chrome installations, such as those in corporate settings, to avoid showing the warning for known intended use cases, or to further lock down and prevent sites from being able to request the permission at all. We plan to continue integrating the Local Network Access permission with different features that can send requests to the local network. For example, we plan to ship Local Network Access for WebSockets, WebTransport, and WebRTC connections soon. We will share more information as we get closer to being able to fully launch Local Network Access in Chrome.
·developer.chrome.com·
New permission prompt for Local Network Access
KB4743: Vulnerabilities Resolved in Veeam Backup & Replication 12.3.2
KB4743: Vulnerabilities Resolved in Veeam Backup & Replication 12.3.2
Issue Details CVE-2025-23121 A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user. Severity: Critical CVSS v3.0 Score: 9.9 Source: Reported by watchTowr and CodeWhite. Note: This vulnerability only impacts domain-joined backup servers. Veeam Backup & Replication Security Best Practice Guide > Workgroup or Domain? Affected Product Veeam Backup & Replication 12.3.1.1139 and all earlier version 12 builds. Note: Unsupported product versions are not tested, but are likely affected and should be considered vulnerable. Solution This vulnerability was fixed starting in the following build: Veeam Backup & Replication 12.3.2 (build 12.3.2.3617) CVE-2025-24286 A vulnerability allowing an authenticated user with the Backup Operator role to modify backup jobs, which could execute arbitrary code. Severity: High CVSS v3.1 Score: 7.2 Source: Reported by Nikolai Skliarenko with Trend Micro. Affected Product Veeam Backup & Replication 12.3.1.1139 and all earlier version 12 builds. Note: Unsupported product versions are not tested, but are likely affected and should be considered vulnerable. Solution This vulnerability was fixed starting in the following build: Veeam Backup & Replication 12.3.2 (build 12.3.2.3617) CVE-2025-24287 A vulnerability allowing local system users to modify directory contents, allowing for arbitrary code execution on the local system with elevated permissions. Severity: Medium CVSS v3.1 Score: 6.1 Source: Reported by CrisprXiang working with Trend Micro Zero Day Initiative. Affected Product Veeam Agent for Microsoft Windows 6.3.1.1074 and all earlier version 6 builds. Note: Unsupported product versions are not tested, but are likely affected and should be considered vulnerable. Solution This vulnerability was fixed starting in the following build: Veeam Agent for Microsoft Windows 6.3.2 (build 6.3.2.1205) Veeam Agent for Microsoft Windows is included with Veeam Backup & Replication and available as a standalone application.
·veeam.com·
KB4743: Vulnerabilities Resolved in Veeam Backup & Replication 12.3.2
NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2025-5349 and CVE-2025-5777
NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2025-5349 and CVE-2025-5777
Severity - Critical Description of Problem A vulnerability has been discovered in NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway). Refer below for further details. Affected Versions The following supported versions of NetScaler ADC and NetScaler Gateway are affected by the vulnerabilities: NetScaler ADC and NetScaler Gateway 14.1 BEFORE 14.1-43.56 NetScaler ADC and NetScaler Gateway 13.1 BEFORE 13.1-58.32 NetScaler ADC 13.1-FIPS and NDcPP BEFORE 13.1-37.235-FIPS and NDcPP NetScaler ADC 12.1-FIPS BEFORE 12.1-55.328-FIPS Details NetScaler ADC and NetScaler Gateway contain the vulnerabilities mentioned below: CVE ID Description Pre-conditions CWE CVSSv4 CVE-2025-5349 Improper access control on the NetScaler Management Interface Access to NSIP, Cluster Management IP or local GSLB Site IP CWE-284: Improper Access Control CVSS v4.0 Base Score: 8.7 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L) CVE-2025-5777 Insufficient input validation leading to memory overread NetScaler must be configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server CWE-125: Out-of-bounds Read CVSS v4.0 Base Score: 9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L)
·support.citrix.com·
NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2025-5349 and CVE-2025-5777
A Wretch Client: From ClickFix deception to information stealer deployment — Elastic Security Labs
A Wretch Client: From ClickFix deception to information stealer deployment — Elastic Security Labs
Elastic Security Labs has observed the ClickFix technique gaining popularity for multi-stage campaigns that deliver various malware through social engineering tactics. Our threat intelligence indicates a substantial surge in activity leveraging ClickFix (technique first observed) as a primary initial access vector. This social engineering technique tricks users into copying and pasting malicious PowerShell that results in malware execution. Our telemetry has tracked its use since last year, including instances leading to the deployment of new versions of the GHOSTPULSE loader. This led to campaigns targeting a broad audience using malware and infostealers, such as LUMMA and ARECHCLIENT2, a family first observed in 2019 but now experiencing a significant surge in popularity. This post examines a recent ClickFix campaign, providing an in-depth analysis of its components, the techniques employed, and the malware it ultimately delivers. Key takeaways ClickFix: Remains a highly effective and prevalent initial access method. GHOSTPULSE: Continues to be widely used as a multi-stage payload loader, featuring ongoing development with new modules and improved evasion techniques. Notably, its initial configuration is delivered within an encrypted file. * ARECHCLIENT2 (SECTOPRAT): Has seen a considerable increase in malicious activity throughout 2025.
·elastic.co·
A Wretch Client: From ClickFix deception to information stealer deployment — Elastic Security Labs
Police seizes Archetyp Market drug marketplace, arrests admin
Police seizes Archetyp Market drug marketplace, arrests admin
Law enforcement authorities from six countries took down the Archetyp Market, an infamous darknet drug marketplace that has been operating since May 2020. Archetyp Market sellers provided the market's customers with access to high volumes of drugs, including cocaine, amphetamines, heroin, cannabis, MDMA, and synthetic opioids like fentanyl through more than 3,200 registered vendors and over 17,000 listings. Over its five years of activity, the marketplace amassed over 612,000 users with a total transaction volume of over €250 million (approximately $289 million) in Monero cryptocurrency transactions. As part of this joint action codenamed 'Operation Deep Sentinel' (led by German police and supported by Europol and Eurojust), investigators in the Netherlands took down the marketplace's infrastructure, while a 30-year-old German national suspected of being Archetyp Market's administrator was apprehended in Barcelona, Spain. One Archetyp Market moderator and six of the marketplace's highest vendors were also arrested in Germany and Sweden. In total, law enforcement officers seized 47 smartphones, 45 computers, narcotics, and assets worth €7.8 million from all suspects during Operation Deep Sentinel.
·bleepingcomputer.com·
Police seizes Archetyp Market drug marketplace, arrests admin
Coming to Apple OSes: A seamless, secure way to import and export passkeys
Coming to Apple OSes: A seamless, secure way to import and export passkeys
Apple OSes will soon transfer passkeys seamlessly and securely across platforms. Apple this week provided a glimpse into a feature that solves one of the biggest drawbacks of passkeys, the industry-wide standard for website and app authentication that isn't susceptible to credential phishing and other attacks targeting passwords. The import/export feature, which Apple demonstrated at this week’s Worldwide Developers Conference, will be available in the next major releases of iOS, macOS, iPadOS, and visionOS. It aims to solve one of the biggest shortcomings of passkeys as they have existed to date. Passkeys created on one operating system or credential manager are largely bound to those environments. A passkey created on a Mac, for instance, can sync easily enough with other Apple devices connected to the same iCloud account. Transferring them to a Windows device or even a dedicated credential manager installed on the same Apple device has been impossible. Growing pains That limitation has led to criticisms that passkeys are a power play by large companies to lock users into specific product ecosystems. Users have also rightly worried that the lack of transferability increases the risk of getting locked out of important accounts if a device storing passkeys is lost, stolen, or destroyed. The FIDO Alliance, the consortium of more than 100 platform providers, app makers, and websites developing the authentication standard, has been keenly aware of the drawback and has been working on programming interfaces that will make the passkey syncing more flexible. A recent teardown of the Google password manager by Android Authority shows that developers are actively implementing import/export tools, although the company has yet to provide any timeline for their general availability. (Earlier this year, the Google password manager added functionality to transfer passwords to iOS apps, but the process is clunky.) A recent update from FIDO shows that a large roster of companies are participating in the development, including Dashlane, 1Password, Bitwarden, Devolutions, NordPass, and Okta.
·arstechnica.com·
Coming to Apple OSes: A seamless, secure way to import and export passkeys
Hackers take aim at Washington Post journalists in an apparent ‘targeted’ cyberattack | CNN Business
Hackers take aim at Washington Post journalists in an apparent ‘targeted’ cyberattack | CNN Business
Hackers have tried to break into the email accounts of a select number of Washington Post journalists, according to an internal Washington Post memo obtained by CNN. The Post discovered the “possible targeted” hack of its email system last Thursday, prompting the newspaper to reset login credentials for all its employees on Friday, Washington Post Executive Editor Matt Murray said in a memo Sunday to employees. “Although our investigation is ongoing, we believe the incident affected a limited number of Post journalists accounts, and we have contacted those whose accounts have been impacted,” Murray said. “We do not believe this unauthorized intrusion impacted any additional Post systems or has had any impact for our customers,” he added. It was not immediately clear who was responsible for the hack. Journalists are regular targets for both state-backed spies, who are interested in tracking their reporting before it becomes public, and cybercriminals, who are interested in extorting news organizations. A spokesperson for The Post declined to comment when asked who might be responsible for the hack.
·edition.cnn.com·
Hackers take aim at Washington Post journalists in an apparent ‘targeted’ cyberattack | CNN Business
World Leaks: An Extortion Platform
World Leaks: An Extortion Platform
  • World Leaks emerged in early 2025 as a new project by the operators of the Hunters International ransomware group, shifting from double extortion with ransomware to extortion-only attacks due to increased risks and reduced profitability. The World Leaks and Hunters International platforms share numerous similarities in design, layout, and functionality. World Leaks operates four distinct platforms: a main data leak site, a negotiation site for ransom payments, an Insider platform for journalists, and an affiliate panel. World Leaks faced initial bugs, downtime, and fluctuations in claimed data leak sizes, raising questions about data accuracy. Despite claiming to be extortion-only, some victims suffered ransomware deployment. * We learned that the Secp0 ransomware group is collaborating with World Leaks, indicating potential future attractiveness for other threat actors.
·blog.lexfo.fr·
World Leaks: An Extortion Platform
Over 46,000 Grafana instances exposed to account takeover bug
Over 46,000 Grafana instances exposed to account takeover bug
More than 46,000 internet-facing Grafana instances remain unpatched and exposed to a client-side open redirect vulnerability that allows executing a malicious plugin and account takeover. The flaw is tracked as CVE-2025-4123 and impacts multiple versions of the open-source platform used for monitoring and visualizing infrastructure and application metrics. The vulnerability was discovered by bug bounty hunter Alvaro Balada and was addressed in security updates that Grafana Labs released on May 21.
·bleepingcomputer.com·
Over 46,000 Grafana instances exposed to account takeover bug
EU allocates €145.5 million to boost European cybersecurity, including for hospitals and healthcare providers
EU allocates €145.5 million to boost European cybersecurity, including for hospitals and healthcare providers
The European Commission is making available €145.5 million to empower small and medium-sized enterprises and public administrations in deploying cybersecurity solutions and adopting the results of cybersecurity research. For this purpose, the European Cybersecurity Competence has launched two calls for proposals. The first call is part of the Digital Europe Programme, with a budget of €55 million. €30 million of this amount will enhance the cybersecurity of hospitals and healthcare providers, helping them detect, monitor, and respond to cyber threats, particularly ransomware. This will boost the resilience of the European healthcare system, especially in the current geopolitical context, aligning with the EU action plan on cybersecurity in hospitals and healthcare. The second call, under Horizon Europe Programme, has a budget of around €90.5 million. It will support the use and development of generative AI for cybersecurity applications, new advanced tools and processes for operational cybersecurity, and privacy-enhancing technologies as well as post-quantum cryptography. The deadline for applications to the first call is 7 October, and for the second, it is 12 November. Both calls for proposals are managed by the European Cybersecurity Competence. The eligibility criteria and all relevant call documents are available on the Funding and Tenders portal. Related topics Cybersecurity Artificial intelligence Digital Europe Programme Funding for Digital Horizon Europe
·digital-strategy.ec.europa.eu·
EU allocates €145.5 million to boost European cybersecurity, including for hospitals and healthcare providers
ICS Patch Tuesday: Vulnerabilities Addressed by Siemens, Schneider, Aveva, CISA
ICS Patch Tuesday: Vulnerabilities Addressed by Siemens, Schneider, Aveva, CISA
Industrial solutions providers Siemens, Schneider Electric and Aveva have released June 2025 Patch Tuesday ICS security advisories. While most of the vulnerabilities described in the advisories have been patched, only mitigations and workarounds are currently available for some of the flaws. Siemens published six new advisories this Patch Tuesday. The most important describes CVE-2025-40585, a critical default credentials issue impacting Siemens Energy Services solutions that use the Elspec G5 Digital Fault Recorder (G5DFR). According to Siemens, this component has default credentials with admin privileges and “a client configuration with remote access could allow an attacker to gain remote control of the G5DFR component and tamper outputs from the device”. Users can mitigate this issue by changing the default credentials from the G5DFR interface. Critical issues are also described in an advisory for Simatic S7-1500 CPUs. Siemens is working on updates for the product to address dozens of vulnerabilities affecting the GNU/Linux subsystem. Two advisories cover medium-severity issues in industrial communication devices that use the Sinec OS. The flaws allow an attacker to “perform actions that exceed the permissions of the ‘guest’ role”. The industrial giant has also informed customers about a Tecnomatix Plant Simulation vulnerability that can lead to arbitrary code execution by tricking a user to open malicious files. The issue was reported by researcher Michael Heinzl, who is often credited by vendors for reporting vulnerabilities whose exploitation involves opening specially crafted files. Siemens also informed customers about an XSS vulnerability in the Palo Alto Networks virtual firewall present in some Ruggedcom devices. Patches are being prepared by Siemens. Schneider Electric has published three new advisories this Patch Tuesday. One of them describes XSS and DoS vulnerabilities affecting some Modicon controllers. Four vulnerabilities have been patched in the EVLink WallBox electric vehicle charging station, including ones that can be exploited for reading or writing arbitrary files, launching XSS attacks, and taking remote control over the charging station. Schneider has also informed customers about vulnerabilities in the third-party real-time operating system powering Insight Home and Insight Facility products. The products have reached end of life and cannot be updated, but users can implement mitigations to reduce the risk of exploitation. Aveva has published three new advisories. One of them describes two high-severity DoS vulnerabilities in the PI Data Archive product. The other two advisories cover medium-severity XSS flaws in PI Connector for CygNet and PI Web API. CISA also published three new advisories on Tuesday. One of them describes high-severity SinoTrack GPS receiver vulnerabilities that can allow an attacker to track vehicles and disconnect power to the fuel pump. The other advisories describe the impact of a 2022 OpenSSL vulnerability on Hitachi Energy Relion products, and a remote code execution flaw discovered by Heinzl in MicroDicom DICOM Viewer. ABB published advisories a few days before Patch Tuesday. The company informed customers about a critical EIBPORT vulnerability that leads to information disclosure, as well as flaws in third-party components used by its Welcome IP-Gateway product. Also on Tuesday, Kaspersky published its ICS threat landscape report for Q1 2025, which shows that the security firm’s products blocked threats on nearly 22% of protected ICS devices. The report looks at threat sources, regional trends, and the prevalence of various types of malware.
·securityweek.com·
ICS Patch Tuesday: Vulnerabilities Addressed by Siemens, Schneider, Aveva, CISA
Inside the LockBit's Admin Panel Leak: Affiliates, Victims and Millions in Crypto
Inside the LockBit's Admin Panel Leak: Affiliates, Victims and Millions in Crypto
On May 7, 2025, the LockBit admin panel was hacked by an anonymous actor who replaced their TOR website with the text ‘Don’t do crime CRIME IS BAD xoxo from Prague’ and shared a SQL dump of their admin panel database in an archived file ‘paneldb_dump.zip’: There is not much information available regarding the individual identified as 'xoxo from Prague' whose objective seems to be the apprehension of malicious ransomware threat actors. It is uncommon for a major ransomware organization's website to be defaced; more so for its administrative panel to be compromised. This leaked SQL database dump is significant as it offers insight into the operational methods of LockBit affiliates and the negotiation tactics they employ to secure ransom payments from their victims. Trellix Advanced Research Center’s investigations into the leaked SQL database confirmed with high confidence that the database originates from LockBit's affiliates admin panel. This panel allows the generation of ransomware builds for victims, utilizing LockBit Black 4.0 and LockBit Green 4.0, compatible with Linux, Windows and ESXi systems, and provides access to victim negotiation chats. The leaked SQL database dump encompasses data from December 18, 2024 to April 29, 2025, including details pertaining to LockBit adverts (aka ransomware affiliates), victim organizations, chat logs, cryptocurrency wallets and ransomware build configurations.
·trellix.com·
Inside the LockBit's Admin Panel Leak: Affiliates, Victims and Millions in Crypto