Shah Sheikh

The threat actor that Microsoft Threat Intelligence tracks as Marbled Dust has been observed exploiting a zero-day vulnerability in the messaging app Output Messenger to collect data from targets in Iraq. The zero-day vulnerability, identified as CVE-2025-27920, is a directory traversal vulnerability in the Output Messenger Server Manager application that could allow an authenticated user to upload malicious files into the server's startup directory. Microsoft Threat Intelligence assesses with high confidence that the targets of the attack are associated with the Kurdish military operating in Iraq, consistent with previously observed Marbled Dust targeting priorities. Microsoft notified Srimax, the developer of the messaging app, upon discovering the zero-day. Srimax has since issued a patch to software update to address the vulnerability. Users are recommended to upgrade Output Messenger to its latest version to address the vulnerability leveraged by Marbled Dust. Read our blog post for more details on this threat: https://msft.it/6047SkVZN

١٦٣

🚨 Akira Ransomware Allegedly Claims Theft of 23GB in Apache OpenOffice Breach | Read more: https://lnkd.in/dtiSyyQm The notorious Akira ransomware group announced on October 29, 2025, that it successfully breached the systems of Apache OpenOffice, exfiltrating a staggering 23 gigabytes of sensitive corporate data. The group, known for its aggressive double-extortion tactics, posted details on its dark web leak site, threatening to release the information unless a ransom is paid. This incident underscores the escalating risks facing even non-profit software foundations in an era of sophisticated cyber threats.​ #cybersecuritynews

٣٨٣

١١ تعليق

Trend Zero Day Initiative™ (ZDI) exposed the tactics of Russian cybercriminals targeting Ukrainian organizations. From spear-phishing to advanced homoglyph attacks, understand the full spectrum of these threats and how to fortify your business against them: https://spr.ly/6047Ir4aF

٩٤

١ تعليق واحد

Kudos to our Penetration Testing Team! 🎉   Once again, they have demonstrated their expertise and sharp skills by uncovering a Reflected Cross-Site Scripting (XSS) vulnerability in the phpIPAM product. This vulnerability has been officially registered with MITRE and assigned the identifier CVE-2024-55093 under the Common Vulnerabilities and Exposures (CVE®) Program. 🛡️ The issue stems from insufficient input validation and encoding, allowing attackers to inject malicious scripts into users’ browsers. If exploited, this could lead to session hijacking, exposure of sensitive data, and other security risks. For more details, check out the following resources: CVE: Common Vulnerabilities and Exposures 👉 https://lnkd.in/dbz_bva5 NVD - CVE-2024-55093 👉 https://lnkd.in/dbz_bva5 Bugfix: XSS - Reflected in install scripts · phpipam/phpipam@d0caaeb · GitHub 👉https://lnkd.in/dz7CYBh3

٧٧

١ تعليق واحد

🚨  New Report: "Inside Gamaredon’s PteroLNK: Dead Drop Resolvers and evasive Infrastructure" 🚨 🔎  As the threat landscape evolves, understanding Gamaredon’s tactics is crucial for defense—not just in Ukraine, but across Europe. This full report provides technical analysis, detection signatures, hashes, and infrastructure indicators for defenders and researchers. Our CTR team has been proactively tracking Russian-nexus threats and recently identified new samples from the Pterodo malware family, closely associated with the Gamaredon APT group. These samples, uploaded between late 2024 and mid-March 2025, reveal that Gamaredon’s Dead Drop Resolvers (DDRs) are still being updated daily—clear evidence of ongoing, active operations. What did we find? 🔹  We provide analysis of PteroLNK VBScript malware which is heavily obfuscated and dynamically constructs a downloader and an LNK dropper. 🔹 The LNK dropper enables rapid propagation across local and network drives by replacing files with deceptive shortcuts, allowing the malware to spread via shared storage. 🔹  Gamaredon leverages Telegraph and Teletype articles as DDRs, which frequently point to Cloudflare quick tunnels—an increasingly popular tactic for blending malicious C2 traffic with legitimate web activity.Why does it matter? Gamaredon’s is as active as ever, but receives little in-depth coverage. Their ability to consistently evade detection and maintain operational impact makes them a persistent threat in the region. Read the report 👉 https://lnkd.in/eBUj4wrr #Infosec #Cybersecurity

٧٢

New Threat Intelligence Report: HITRUST CSF Threat & Mitigation Analysis – 2025 1H Cyber threats don’t stand still — and neither does HITRUST. In 1H 2025, our cyber threat-adaptive process analyzed - 220,000+ threat indicators - 4,100 threat intel articles - 435 real-world breaches - 41,000 MITRE ATT&CK mappings The result? An always-evolving framework with controls that respond to today’s threats. Read now. https://lnkd.in/gqDkiMjK #RiskManagement #ThreatIntelligence #SecurityFramework

٣٣

١ تعليق واحد

🚨 New Report Released: 2024–25 Initial Access Landscape ThreatMon’s latest report exposes the industrial scale of the Initial Access Broker (IAB) ecosystem — a critical enabler of ransomware, espionage, and financial fraud. 🔍 Key Insights: • 6,000+ unauthorized access listings across 156 countries • U.S. remains the most targeted nation (56%) • Government, e-commerce, and finance sectors hit hardest • Access often includes RDP, VPN, CMS, and full server control • Top actors: miyak0, ProfessorKliq, diamond, and sentap 🧠 Discover how IABs operate through darknet forums, Telegram, and onion marketplaces — and why their growing role demands a proactive defense. ➡️ https://lnkd.in/gUkUgXWK #CyberSecurity #InitialAccess #DarkWebIntel #ThreatReport #ThreatMon #IAB #Ransomware #Infosec #CyberThreats

٤٢

١ تعليق واحد

The National Security Agency and the Cybersecurity and Infrastructure Security Agency (CISA) have released the joint Cybersecurity Information Sheet (CSI), “Memory Safe Languages: Reducing Vulnerabilities in Modern Software Development,” to highlight the importance of adopting memory safe languages (MSLs) in improving software security and reducing the risk of security incidents. Memory safety effects all software development and is a critical aspect to a holistic approach to security. The importance of memory safety is critical, and the consequences of vulnerabilities can be severe, to include data breaches, system crashes, and operational disruptions. Adopting MSLs will directly improve software security for all. To strengthen national cybersecurity and reduce memory vulnerabilities, software producers, especially those for National Security Systems (NSS) and critical infrastructure, should utilize this guidance to plan for and begin using MSLs for their software systems. 🔗 Read the full report: https://lnkd.in/eeJ2SMm7

٣٦٢

٣٧ تعليق

🚨 Q2 2025 Ransomware Report: The threat landscape was highly active with new groups emerging, existing ones rebranding, and expanded Initial Access Broker (IAB) operations. Geopolitical tensions—particularly the Israel-Iran conflict—added a new dimension to ransomware threats, with hacktivist groups employing ransomware against industrial targets and Iranian-based groups offering higher payouts for successful attacks on U.S. and Israeli organizations. 👉 Get the full analysis at: https://hubs.la/Q03CKX8N0 #icscybersecurity #otcybersecurity #industrialcybersecurity #ransomware #DragosIntel

٤٢

١ تعليق واحد

Traditional SOCs weren’t built for the cloud, but modern threats demand modern defenses. 🛡️ 💡 How much do you know about the role of the Security Operations Center (#SOC) in #CloudSecurity? ⤵️ 𝗢𝘂𝗿 𝗹𝗮𝘁𝗲𝘀𝘁 𝗟𝗖𝗡 𝗮𝗿𝘁𝗶𝗰𝗹𝗲 𝘄𝗶𝗹𝗹 𝘁𝗲𝗮𝗰𝗵 𝘆𝗼𝘂: ✅ The purpose and benefits of a SOC ✅ Challenges SOC teams face today ✅ The team members who make up a SOC ☁️ Visit Sysdig's 𝘓𝘦𝘢𝘳𝘯 𝘊𝘭𝘰𝘶𝘥 𝘕𝘢𝘵𝘪𝘷𝘦 (LCN) hub to uncover how SOCs are evolving to overcome the unique demands of our multi-cloud landscape: https://okt.to/1gDLzJ

٣٢

🕷️ Threat groups like Scattered Spider aren’t just exploiting known vulnerabilities. Chief Scientific Officer Raja Mukerji explains how attackers are abusing legitimate tools and trusted software to infiltrate networks — and how robust #NDR platforms can spot these tactics before it’s too late. https://xtra.li/455H9LG

٥٥

🚨 STRIKE Threat Intel Advisory – CVE-2024-27443 🚨 SecurityScorecard’s STRIKE team is tracking active exposure of CVE-2024-27443 — a medium-severity vulnerability currently being exploited in the wild and is found to be targeting government entities and defense companies. On May 19, 2025, this vulnerability was added to CISA’s list of Known Exploited Vulnerabilities (CISA-KEV). STRIKE has identified over 30,000 IPs that are potentially vulnerable to this CVE via Attack Surface Intelligence. 🔗 Full advisory and ongoing updates: https://bit.ly/43uioXL

٣٤

📰 "The first advisory, ICSA-25-155-01, addresses multiple high-impact issues in CyberData’s 011209 SIP Emergency Intercom. With a CVSS v4 severity score of 9.3, this vulnerability, reported by Claroty researcher Vera Mens, enables authentication bypass, SQL injection, and path traversal." | via The Cyber Express By Cyble https://hubs.li/Q03s5FSv0

٢١

Quick 60-Second Cyber Threat Brief! Key Threats in Focus: • NEZHA Ransomware – Double extortion & WMI abuse • GhostRedirector APT – China-aligned espionage & data theft • LockBeast Ransomware – Double extortion & data leak threat These threats are targeting healthcare, finance, and government sectors right now. Be Educated. Act Fast. Secure Your System. Full Report: https://lnkd.in/g_zvmfMa The CISO Society | Intelligent CISO | ETCISO | CISO Frontiers | CISOStreet | CISO FORUM | CISO as a Service #Cybersecurity #ThreatIntelligenceReport #CyberThreats2025 #SecurityAlerts

٢٤

𝗖𝘆𝗯𝗲𝗿𝗮𝘁𝘁𝗮𝗰𝗸𝘀 𝗮𝗿𝗲 𝗲𝘃𝗼𝗹𝘃𝗶𝗻𝗴. 𝗦𝗼 𝗮𝗿𝗲 𝘄𝗲. 𝘍𝘳𝘰𝘮 #𝘱𝘩𝘪𝘴𝘩𝘪𝘯𝘨 𝘢𝘯𝘥 #𝘳𝘢𝘯𝘴𝘰𝘮𝘸𝘢𝘳𝘦 𝘵𝘰 𝘪𝘯𝘴𝘪𝘥𝘦𝘳 𝘵𝘩𝘳𝘦𝘢𝘵𝘴 𝘢𝘯𝘥 𝘴𝘶𝘱𝘱𝘭𝘺 𝘤𝘩𝘢𝘪𝘯 𝘦𝘹𝘱𝘭𝘰𝘪𝘵𝘴 - 𝘵𝘩𝘦 𝘵𝘩𝘳𝘦𝘢𝘵 𝘭𝘢𝘯𝘥𝘴𝘤𝘢𝘱𝘦 𝘪𝘴 𝘰𝘯𝘭𝘺 𝘨𝘦𝘵𝘵𝘪𝘯𝘨 𝘮𝘰𝘳𝘦 𝘤𝘰𝘮𝘱𝘭𝘦𝘹. This datasheet breaks down today’s most common #cyberattacks and shows how Seceon delivers real-time visibility, behavioral analytics, and automated threat response to stop them cold.  • 𝗘𝗮𝗿𝗹𝘆-𝘀𝘁𝗮𝗴𝗲 ransomware detection  • 𝗨𝗘𝗕𝗔 for insider threat and privilege abuse  • 𝗔𝗻𝗼𝗺𝗮𝗹𝗼𝘂𝘀 𝗹𝗼𝗴𝗶𝗻 𝗮𝗹𝗲𝗿𝘁𝘀 to catch credential theft  • 𝗔𝗣𝗜-𝗹𝗲𝘃𝗲𝗹 𝘃𝗶𝘀𝗶𝗯𝗶𝗹𝗶𝘁𝘆 to secure your supply chain  • 𝗨𝗻𝗶𝗳𝗶𝗲𝗱 aiXDR, aiSIEM, and SOAR in one platform 𝗕𝘂𝗶𝗹𝘁 𝗳𝗼𝗿 𝗠𝗦𝗦𝗣𝘀. 𝗦𝗰𝗮𝗹𝗮𝗯𝗹𝗲 𝗳𝗼𝗿 𝗲𝗻𝘁𝗲𝗿𝗽𝗿𝗶𝘀𝗲𝘀. 𝗡𝗼 𝗶𝗻𝗴𝗲𝘀𝘁 𝗳𝗲𝗲𝘀. #Cybersecurity #XDR #SIEM #SOAR #ThreatDetection #CyberThreats #AIinCybersecurity #MSSP #Seceon #CyberDefense Shikha Pandey Chandra Shekhar Pandey Argha Bose Sana Anjali Devi Vinay Ojha Madan Mohan Pandey Pushpendra Mishra 🇮🇳 Kriti Tripathi Aashish Kumar Goela Jocelyn Joy Amancio Britto

٣٥

#FINSEC2025: The first keynote of 𝐃𝐒𝐂𝐈 𝐅𝐈𝐍𝐒𝐄𝐂 𝐂𝐨𝐧𝐜𝐥𝐚𝐯𝐞 2025 | 𝐃𝐚𝐲 1 was delivered by Mr. Tarique Ansari, Senior Manager – Security Consultant at Palo Alto Networks, on Cybersecurity in the Age of AI. He highlighted how Palo Alto’s Precision AI is proactively combating the surge of adversarial AI—technology that’s evolving faster than anyone anticipated. Citing that 57% of employees now use public #GenAI tools weekly, he emphasised the deep integration of AI in workplace environments, from productivity enhancements to engagement in viral trends. While GenAI accelerates output by summarising meetings, generating marketing assets, and enabling seamless collaboration, it also introduces unforeseen security vulnerabilities. Mr. Ansari’s address was a crucial reminder: as AI becomes more embedded in business operations, cybersecurity strategies must evolve in tandem with speed, precision, and foresight. #FinancialSecurity #Mumbai #DSCI

١٥