NEW BOT Телеграм, страница

CVE-2025-33053, Stealth Falcon And Horus: A Saga Of Middle Eastern Cyber Espionage

The threat actors used a previously undisclosed technique to execute files hosted on a WebDAV server they controlled, by manipulating the working directory of a legitimate built-in Windows tool. Microsoft assigned the vulnerability CVE-2025-33053 and released a patch on June 10, 2025, as part of their June Patch Tuesday updates.

https://research.checkpoint.com/2025/stealth-falcon-zero-day/

Check Point Research

Stealth Falcon's Exploit of Microsoft Zero Day Vulnerability - Check Point Research

Check Point Research uncovers Stealth Falcon's cyber espionage campaign exploiting a Microsoft Zero Day Vulnerability

3.19K views06:44

Sys-Admin InfoSec

Forwarded from Sys-Admin Up (Yevgeniy Goncharov)

Another Crack in the Chain of Trust: Uncovering (Yet Another) Secure Boot Bypass

https://www.binarly.io/blog/another-crack-in-the-chain-of-trust

www.binarly.io

Another Crack in the Chain of Trust: Uncovering (Yet Another) Secure Boot Bypass

Binarly uncovers CVE-2025-3052: a Secure Boot bypass affecting most UEFI devices, enabling attackers to run unsigned code before OS load.

2.3K views07:53

Sys-Admin InfoSec

Forwarded from OpenBLD.net (Yevgeniy Goncharov)

OpenBLD.net - Phishing Preveting - Toxic trend: Another malware threat targets DeepSeek

DeepSeek-R1 is one of the most popular LLMs right now. Users of all experience levels look for chatbot websites on search engines, and threat actors have started abusing the popularity of LLMs...

Phishing lure, Malicious installer, Loaded implant and more:

https://securelist.com/browservenom-mimicks-deepseek-to-use-malicious-proxy/115728

2.29K views08:02

Sys-Admin InfoSec

Red / Blue team, багбаунти, пентесты - ключевой навык в инфобезе.

Самое время прокачать навык веб-пентеста.

Курс от Яндекс Практикума в Казахстане.

Освоить веб-пентест за 6 месяцев, научиться искать уязвимости и защищать веб-приложения, что может быть проще?)

Что внутри:

• Учат и атаковать, и защищать
• Практика в облаке в формате CTF
• Наставники — практикующие специалисты
• Есть модули по безопасному коду и DevSecOps

Подходит опытным айтишникам и студентам техвузов.

Можно протестировать себя - пройдя бесплатный тест на вход.

🎁 Промокод KZ2025 — скидка 12%. Детали → Здесь.

Партнёрский материал

2.57K viewsedited 04:50

Sys-Admin InfoSec

GreyNoise - Observes Exploit Attempts Targeting Zyxel CVE-2023-28771

https://www.greynoise.io/blog/exploit-attempts-targeting-zyxel-cve-2023-28771

www.greynoise.io

GreyNoise Observes Exploit Attempts Targeting Zyxel CVE-2023-28771

‍On June 16, GreyNoise observed exploit attempts targeting CVE-2023-28771 — a remote code execution vulnerability affecting Zyxel Internet Key Exchange (IKE) packet decoders over UDP port 500.

2.63K viewsedited 13:58

Sys-Admin InfoSec

Threat Advisory: LightPerlGirl Malware

https://www.todyl.com/blog/threat-advisory-lightperlgirl-malware

Todyl

Threat Advisory: LightPerlGirl Malware | Todyl

Learn about the newest threat uncovered by the Todyl team: the LightPerlGirl malware strain, propagated through ClickFix fake CAPTCHA.

2.58K views05:21

Sys-Admin InfoSec

Clone, Compile, Compromise: Water Curse’s Open-Source Malware Trap on GitHub

...The malware enables data exfiltration (including credentials, browser data, and session tokens), remote access, and long-term persistence on infected systems ... a supply chain risk, especially to cybersecurity professionals, game developers, and DevOps teams relying on open-source tooling..:

https://www.trendmicro.com/en_us/research/25/f/water-curse.html

Trend Micro

Clone, Compile, Compromise: Water Curse’s Open-Source Malware Trap on GitHub

The Trend Micro™ Managed Detection and Response team uncovered a threat campaign orchestrated by an active group, Water Curse. The threat actor exploits GitHub, one of the most trusted platforms for open-source software, as a delivery channel for weaponized…

3.14K views12:41

Sys-Admin InfoSec

ConnectUnwise: Threat actors abuse ConnectWise as builder for signed malware

Since March 2025 there has been a noticeable increase in infections and fake applications using validly signed ConnectWise samples. Article reveal how bad signing practices allow threat actors to abuse this legitimate software to build and distribute their own signed malware and what security vendors can do to detect them:

https://www.gdatasoftware.com/blog/2025/06/38218-connectwise-abuse-malware

Gdatasoftware

Threat Actors abuse signed ConnectWise application as malware builder

Since March 2025, there has been a noticeable increase in infections and fake applications using validly signed ConnectWise samples. We reveal how bad signing practices allow threat actors to abuse this legitimate software to build and distribute their own…

2.71K views13:08

Sys-Admin InfoSec

Anatomy of a HexEval Loader

https://socket.dev/blog/north-korean-contagious-interview-campaign-drops-35-new-malicious-npm-packages

Socket

Another Wave: North Korean Contagious Interview Campaign Dro...

North Korean threat actors linked to the Contagious Interview campaign return with 35 new malicious npm packages using a stealthy multi-stage malware ...

3.05K views17:46

Sys-Admin InfoSec

Ongoing Campaign Abuses Microsoft 365’s Direct Send to Deliver Phishing Emails

https://www.varonis.com/blog/direct-send-exploit

Varonis

Ongoing Campaign Abuses Microsoft 365’s Direct Send to Deliver Phishing Emails

Varonis Threat Labs uncovered a phishing campaign with M365's Direct Send feature that spoofs internal users without ever needing to compromise an account.

3.88K views17:42

Sys-Admin InfoSec

Forwarded from Sys-Admin Up (Yevgeniy Goncharov)

Local Privilege Escalation via chroot option

An attacker can leverage sudo’s -R (--chroot) option to run arbitrary commands as root, even if they are not listed in the sudoers file:

https://www.sudo.ws/security/advisories/chroot_bug/

Sudo

Local Privilege Escalation via chroot option

An attacker can leverage sudo’s -R (--chroot) option to run arbitrary commands as root, even if they are not listed in the sudoers file.
Sudo versions affected: Sudo versions 1.9.14 to 1.9.17 inclusive are affected.
CVE ID: This vulnerability has been assigned…

2.91K views10:34

Sys-Admin InfoSec

Forwarded from Yevgeniy Goncharov

📢 Open SysConf’25 зовёт спикеров!

Есть чем поделиться? Пора выйти на сцену.

📍 4 октября 2025 — день, когда на одной сцене снова соберутся те, кто делает, думает и двигает.

А ты - продолжаешь откладывать? Всё ждёшь "подходящего момента"?

Вот он. Это твой шанс выступить и рассказать миру, что ты понял, построил, сломал или переосмыслил за этот год.

Мы ждём твой доклад, если ты хочешь рассказать о:

- технологиях и коде
- инфраструктуре и хаках
- безопасности, мониторинге, Dev(Sec/App)Ops, ML, IaC, sysadmin'стве и тех/хак ресерчах и наработках
- человеческом факторе, ошибках, росте и том, как не сгореть по дороге

Подать заявку просто: 👉 https://sysconf.io/2025

Твои знания могут стать триггером для чьего-то роста.

Ты с нами? Тогда Welcome! ✌️

2.87K views05:51

Sys-Admin InfoSec

Unmasking AsyncRAT: Navigating the labyrinth of forks

https://www.welivesecurity.com/en/eset-research/unmasking-asyncrat-navigating-labyrinth-forks/

Welivesecurity

Unmasking AsyncRAT: Navigating the labyrinth of forks

ESET researchers map out the labyrinthine relationships among the vast hierarchy of AsyncRAT variants.

2.53K views02:03

About

Blog

Apps

Platform