Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Latest News

PostgreSQL’s Largest Ever Security Release Patches 52 Flaws, Including a 22-Year-Old Bug Any Logged-In User Could Weaponize

  The PostgreSQL Global Development Group shipped security updates on November 12 for all five supported major versions, issuing fixes for 5...

All the recent news you need to know
Malicious calls
Cyber Attacks cyber espionage Cyber Security and Privacy Device Security Fraudulent Message Hacking Attack Malicious calls

SilentAir Hacks Asian Telecom Networks to Intercept Calls and SMS Verification Codes

 

A cyber espionage group known as SilentAir has been attacking telecoms infrastructure throughout Asia to listen in on selected individuals’ calls and text messages. This was uncovered by Enea, a telecom security firm based in Stockholm. They believe with high confidence that the campaign is state-sponsored, however it is uncertain how connected it is to China. Enea were able to trace the attacks to compromised devices within mobile operators in at least 6 countries throughout Asia. 

They have informed the operators but cannot confirm that all devices are now clean. SilentAir attacked the trust between mobile networks using the SS7 and Diameter protocols to communicate. This communication occurs on the IPX network which links all operators together. They sent false UpdateLocation messages to the compromised devices claiming they were the serving network for targeted users. When this was accepted calls and texts were redirected towards the attacker. Whilst they were intercepting some calls, Enea were able to see SMS 2FA codes being captured straight after the redirection. This suggests they were trying to breach other accounts for their victims. 

However during their investigation there was no confirmation that they were able to take over any accounts, nor was there any evidence of voice calls being intercepted. Intercepting calls made up 18.3% of the attacks they observed compared to only 2.1% from their previous research into common signalling attacks. There were many high value targets such as political and government individuals. 

In some cases multiple compromised devices were used across different countries to target the same individuals suggesting there was some central control. The attacks occurred in short bursts. At times thousands of subscribers were targeted but then nothing happened for months. Whilst the main focus was Taiwan, networks across Southeast Asia, East Asia, East Africa, Central Asia, Middle East and Europe were also targeted. 

There was a large amount of silent SMS being used. Many targeted Taiwanese subscribers during the evening, potentially to check if the redirection was working. Many were sent during the day to subscribers on other networks. The messages had generic English text relating to promotions and motivation, so could have been seen as spam if the silent settings were turned off by the operators. Enea started to see strange signalling activity in early 2025. 

Eventually they were able to see compromised devices sending and receiving attack commands confirming that the operators internal infrastructure had been compromised. They looked into potential links with another telecom focussed threat group called Liminal Panda but there wasn’t enough evidence to connect them. SilentAir also had similarities to SCTPE, a Linux based tool used to manage SS7 and Diameter traffic. This has been referred to as SIGweaver within a government advisory from Singapore. 

However the capabilities differ and there was not enough operational security to link them. Liminal Panda activity was also detected by Enea across multiple customer networks in early 2026. They blocked GTPDoor backdoor traffic across at least 5-10 operators. The new version of this is harder to detect as it hides the commands within GTP-U traffic.

Enea recommend using GTP-C and GTP-U firewalls, treating all IPX connections as untrusted and ensuring telecom monitoring is brought into the wider IT security.
Read more »
StealC
CastleRAT GootLoader Malware Operation Endgame StealC

Operation Endgame Takes Down Three Malware Networks, Recovers 6.4 Million Stolen Logins


An international law enforcement operation has shut down the infrastructure behind three major malware operations: Gootloader, CastleRAT and StealC, seizing 235 servers and 257 domains used by cybercriminals to distribute malicious software, steal sensitive information and support ransomware attacks.

Operation endgame disrupts three major malware networks

The coordinated action, conducted as part of Operation Endgame, also resulted in the identification and seizure of approximately 6.4 million stolen login credentials belonging to victims worldwide. According to Germany's Federal Criminal Police Office (BKA), the credentials were associated with more than 40,000 victims.

Gootloader spread malware through compromised websites

Gootloader is a malware loader that enables attackers to gain initial access to compromised computers and subsequently install additional malicious programs, including ransomware. Its operators distributed malware through fake legal documents hosted on compromised websites, frequently exploiting hacked WordPress sites.

The attackers also used search engine optimisation (SEO) poisoning to manipulate search results and direct unsuspecting users towards malicious downloads. 

Since 2018, Gootloader has infected at least 25,000 computers worldwide, according to the U.S. Department of Justice. In the United States alone, the malware has been linked to ransomware attacks against at least 44 victims, resulting in estimated losses of approximately $28.8 million.

As part of the operation, authorities dismantled 14 servers and 218 domains associated with Gootloader and cleaned 681 compromised websites.

Castlerat and stealc enabled remote access and credential theft

The investigation also targeted CastleRAT, a remote access trojan that allows attackers to remotely control infected systems and use them for malicious activities. Authorities seized 120 servers and 39 domains linked to the operation.

Meanwhile, StealC, an information-stealing malware, was another major target. The malware is designed to extract sensitive information, including passwords, stored credentials and digital identities, from compromised computers. 

This latest disruption follows an earlier law enforcement action against StealC in June 2026. Following that operation, its operators reportedly rebuilt their infrastructure and resumed activities to evade investigators.

Europol's European Cybercrime Centre (EC3) supported the investigation through cyber intelligence, financial tracking and victim identification. Authorities also plan to make information about affected users available through several cybersecurity platforms, including Have I Been Pwned, and the Shadowserver Foundation.

Although no arrests were announced during this latest action, Dutch authorities have continued investigations targeting Gootloader's suspected main operator.

Read more »
UTA Data Breach
Data Breach Higher Education Cybersecurity Qilin Ransomware Ransomware Attack Student Data Theft University Cybersecurity University Of Texas At Arlington Cyberattack UTA Data Breach

Hackers Steal Personal Information in Cyberattack on University of Texas at Arlington


UTA has confirmed that hackers have stolen personal information as a result of a cyberattack last month that affected its IT environment. A university investigation into unauthorized activity has led to this disclosure, although the university has not yet determined the full extent of the data exposure or identified all individuals whose information may have been compromised as a consequence of the data exposure. 

During a response to Recorded Future News, a university spokesperson confirmed the investigation identified data theft, but did not provide specific details regarding which types of information were accessed by the attackers. As part of the university's ongoing efforts to determine the scope and nature of the compromised data and identify potentially affected students and employees, we are currently conducting research. 

According to UTA, individuals who are identified as affected will receive notifications describing the incident, the information involved, and the methods available for protecting their personal information. In addition, the university plans to provide support and guidance to individuals whose information has been exposed. 

In the initial phase, the incident was noticed following disruptions involving MachForms, an online platform used for registrations, service requests, surveys, and other administrative functions. UTA immediately took the platform offline as a precautionary measure following the discovery of the security incident. 

While the investigation continues, MachForms will remain unavailable. The university has also monitored its IT environment to detect any further impacts on its systems or daily operations. There has been no specific timeline provided for the restoration of the affected service. With approximately 41,000 undergraduate and graduate students, The University of Texas at Arlington is one of the most prestigious higher education institutions in Texas. 

It is alarming to learn that personal information belonging to academic and administrative members of the university was stolen, raising concerns about the possibility of sensitive data being exposed. A ransomware attack was claimed earlier this week by the Qilin ransomware group. Qilin has established itself as one of the most active ransomware groups targeting a variety of industries. 

Halcyon Ransomware Research Center figures indicate that between July and September 2026, the group is believed to be linked to 344 alleged ransomware incidents, placing it among the top ransomware operators at that time. In addition to the recent arrest of one of the ransomware operation's prominent affiliates in Japan and extradition to Germany, Qilin has also been attracting attention as a result of a series of developments involving its affiliates and leadership. 

The Russian national Aleksey Mikhailovich Yakovtsev has been identified as a leader of the ransomware network by cybersecurity companies and independent researchers, adding to ongoing investigations into the individuals behind the ransomware network. In addition to claiming responsibility for attacks on the US Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF), the group has also claimed responsibility for attacks on government and institutional targets in the past few months. 

Using its double-extortion strategy, the organization threatens to publish the stolen files if victims refuse to pay ransom. These tactics increase the workload on organizations, particularly those that handle large volumes of personal and administrative information. This incident occurs during a period when higher education institutions are experiencing a series of ransomware attacks. 

According to York University's recent announcement, attackers have accessed and taken substantial amounts of student information, including more than a decade of student records. Besides raising concerns about the long-term exposure of personal information maintained by academic institutions, Vanderbilt University has also suffered from a separate ransomware attack which has adversely affected its operations. 

University officials have advised that it may take several weeks to restore normal operation across the university's systems. The university's efforts to recover are concentrating on essential services such as payroll, payment processing, admissions, course registration, and public safety. Vanderbilt remains under investigation for possible data theft. 

A group responsible for BYOD ransomware has claimed responsibility for the incident at Vanderbilt, as well as recent attacks that affected Michigan State University and New Mexico University. Newly emerging groups and their operations are relatively unknown to researchers. There has been an increasing number of attacks against universities, which have highlighted the risk faced by educational institutions that maintain extensive student, employee, and administrative databases. 

Having disruptions to academic services, combined with unauthorized access to personal data, can adversely affect institutions and their communities for a long period of time. Immediately, the top priority at UTA is determining the scope of the breach, identifying those affected, and restoring the impacted services in a secure manner. 

As higher education institutions manage large quantities of sensitive student and employee data, cybersecurity risks are becoming increasingly important. As UTA continues to assess the extent of the breach and identify affected individuals, this case illustrates the importance of strengthened data protection measures, timely incident response, and continuous monitoring of university information technology systems. 

As well as reflecting the persistent threat that ransomware groups pose to educational institutions, Qilin's involvement also demonstrates the possibility of long-term consequences when disrupting operations and revealing data.
Read more »
third party breach
Baker Tilly Customer Data Data Breach notification Ransomware third party breach

Baker Tilly Discloses Third-Party Data Breach Affecting Nearly 196,000 Individuals

 



Baker Tilly Advisory Group has begun notifying clients about a data breach involving an external service provider, after an unauthorized actor obtained personal information belonging to certain clients and their dependents.

The compromised information was stored on a platform operated by a third-party provider that Baker Tilly uses to deliver its client services. According to the company's notification letter, Baker Tilly discovered the incident on September 6, 2026, and completed its review of the affected records on October 28, identifying the individuals whose information had been exposed.

In its notification, Baker Tilly stated that it became aware of a potential cybersecurity incident involving information maintained on the third-party platform. The company subsequently confirmed that an unauthorized party had obtained data associated with some of its clients.


Nearly 196,000 Individuals Reportedly Affected

Although Baker Tilly's notification does not disclose an overall number of affected individuals or identify the third-party service provider, regulatory disclosures provide further details about the incident's scale.

A filing submitted to the Texas Attorney General's Office lists 10,456 affected Texas residents. The disclosure identifies individuals' full names, addresses, Social Security numbers (SSNs), and other information among the compromised data categories.

The same filing reportedly records a nationwide impact of 195,512 individuals. Additional state disclosures include 1,359 affected residents in South Carolina and 2,689 in Massachusetts. However, the company has not independently provided a consolidated figure in its customer notification.

The sample notification letter published through state regulatory disclosures also contains an unfilled placeholder where the specific categories of compromised personal information should appear. Consequently, the Texas filing currently provides the clearest publicly available breakdown of the exposed information.


Baker Tilly Investigates Third-Party Security Incident

Following the discovery, Baker Tilly says it initiated containment measures and engaged external cybersecurity specialists to investigate the incident, establish its scope, and determine which information had been accessed. The company also notified law enforcement authorities and stated that it is cooperating with their investigation.

Baker Tilly maintains that its investigation has found no evidence of continued unauthorized access to its own network or systems. It has also reported no known instances of identity theft or fraud connected to the compromised information.

However, the absence of reported fraudulent activity does not establish that the exposed information cannot be misused in the future, particularly where government identification numbers and residential information are involved.


Affected Individuals Offered 24 Months of Experian Protection

To address potential consequences of the exposure, Baker Tilly is providing affected individuals with complimentary access to Experian IdentityWorks for 24 months.

According to the notification letter, the package includes credit monitoring, identity restoration assistance, and access to specialists who can help investigate and resolve identity theft incidents. The membership also includes up to $1 million in identity theft insurance, subject to the applicable policy conditions and exclusions.

The company has advised recipients to monitor their financial statements and credit reports for unfamiliar transactions or other suspicious activity.


Baker Tilly's Global Operations

Baker Tilly provides accounting, auditing, tax, consulting, and business advisory services. Its international network reported annual revenue of $6.8 billion for the financial year ending December 31, 2025, representing a 21.3% increase over the previous year.

According to its January 2026 financial announcement, the network comprises more than 50,400 professionals operating across 147 territories and 754 offices.

The company has not publicly identified the compromised service provider or explained how the unauthorized actor gained access to its platform. BleepingComputer also reported that it had contacted Baker Tilly seeking clarification about the incident, affected customer numbers, and compromised information but had not received a response at publication time.

No ransomware group had publicly claimed responsibility for the incident at the time of reporting.

Read more »
Supply-Chain Attack
Credential Theft Cyber Attacks GitHub Supply-Chain Attack

Massive GitHub Supply-Chain Attack Exposes Secrets in 1,800+ Repositories

 

A large-scale software supply-chain attack has compromised thousands of GitHub accounts and exposed secrets across more than 1,800 repositories. According to Aikido Security, an attacker used stolen credentials to gain write access to GitHub accounts and planted a malicious continuous-integration (CI) workflow designed to steal cloud credentials, tokens, and other sensitive information. The malicious code was inserted into repositories and often removed within minutes, making the incident difficult to detect. The campaign demonstrates how compromised developer accounts can be weaponized to attack the software supply chain, potentially affecting organizations far beyond the initially targeted repositories. 

The attackers reportedly gained control of 4,837 hijacked GitHub accounts and used their write permissions to insert a secret-stealing payload into repositories. The malicious workflow ran in at least 1,806 repositories, meaning credentials and cloud roles accessible to those repositories’ CI pipelines should be treated as compromised. The campaign began with seemingly harmless pull requests titled “docs: dependency audit notes,” submitted from branches named wfx-docs. These requests were opened in 61,764 repositories, apparently to test whether the compromised accounts could write to them, before malicious commits were added to a smaller group of targets. 

A separate analysis by SafeDep identified 8,093 public repositories that received malicious commits between 12:46 UTC on Tuesday and 04:36 UTC the following day. Because the researchers examined only default branches of public repositories, the actual number of affected repositories is likely higher. In 7,309 repositories, the attacker added the stealer to an existing GitHub Actions workflow. In another 771 repositories, it was inserted as an npm postinstall hook, which could execute on a developer’s machine when they ran npm install. After deploying the payload, the attacker frequently reverted the changes within minutes and deleted workflow logs, sometimes removing the workflow run entirely. 

The malware collected a broad range of sensitive material from CI runners, including GitHub Actions secrets and variables, the workflow’s GITHUB_TOKEN, OIDC and runtime tokens, AI-service keys, and credentials stored in process memory. It also searched for credential files associated with AWS, Azure, Google Cloud, Kubernetes, npm, PyPI, and SSH. The attack was not limited to stealing short-lived tokens: researchers found that the malware could exchange GitHub OIDC tokens for AWS, Google Cloud, and Azure sessions, potentially allowing the attacker to move deeper into cloud environments.

On AWS, the stealer could create long-lived access keys for IAM users and rewrite a role’s trust policy to make it accessible from other AWS accounts. In Azure, it could add federated identity credentials prefixed with wfx-ci- to Entra ID applications, allowing workflows to authenticate even after original tokens were rotated. Repository owners should search for suspicious branches such as wfx-docs, ci-check-[0-9]{4}, and short-lived chore/ branches. They should also look for pull requests titled “docs: dependency audit notes” and commits labeled ci: refresh build cache, chore: add ci helper, ci: restore, or ci: cleanup. 

Other indicators include unexpected workflow files, a .ci-xxxxxx.sh script, an npm postinstall hook, and the SHA-256 hash 89695abb392d5cfd4972672961e644bb46baa98aa1ed7173c2a2816c762735cf. Affected repository owners should immediately revoke the compromised account’s tokens, OAuth grants, SSH keys, and active sessions, then enable two-factor authentication. They must also rotate every secret, variable, cloud credential, and API key that the affected repository or CI workflow could access. Developers who ran npm install on an affected commit should treat their machines as compromised and rotate local keys and credentials. 

Organizations should also review GitHub Actions permissions, restrict workflow access to secrets, require approval for changes from outside collaborators, and monitor cloud logs for suspicious identity activity. This incident highlights that developer accounts, CI systems, and cloud identities are now primary targets in software supply-chain attacks, making strong authentication, least-privilege access, secret rotation, and continuous monitoring essential defenses.
Read more »
Malicious Code
Apache Apache Server Attack Apache Vulnerability Critical security flaw Cyber Security HTTP HTTP Attacks Malicious Code

Apache HTTP/2 Security Flaw Exposes Servers to Critical Remote Code Execution Attacks

 

A new vulnerability in Apache HTTP Server could allow an attacker to run malicious code remotely on vulnerable systems. The vulnerability, tracked as CVE-2026-119618, affects the HTTP/2 module (mod_http2) and has a CVSS score of 9.8 which means it is critical. This has been fixed in Apache version 2.4.71 which was released on the 11th November 2026. 

The Apache versions affected are between 2.4.55 and 2.4.70. However, only systems where HTTP/2 has been enabled are vulnerable. Red Hat state "An attacker with network access to a vulnerable system could exploit this vulnerability to take control of the server process." As no authentication is required systems that are network accessible could be at high risk. Red Hat’s analysis of the vulnerability states that there is public research showing a reliable exploit for a server running the default configuration and mod_http2 enabled. The research was not detailed or sourced. 

However, cybersecurity firm Wiz state that there is no exploit available and no attacks have been observed in the wild. HTTP/2 is not enabled by default. It can be enabled globally for all virtual hosts or just on specific virtual hosts. This is done by adding ‘h2’ to the Protocols directive for secure HTTP/2 (TLS) or ‘h2c’ for insecure HTTP/2 (TCP). All configuration files should be reviewed by the security team. Apache recommend upgrading to version 2.4.71. This also includes a fix for a crash issue in mod_md (Important) and a memory overwrite vulnerability in mod_vhost_alias (Low severity). If you are using official builds of Apache then administrators should upgrade to the latest version. This also affects standalone versions of the HTTP/2 module (mod_h2). 

These versions affected are between 2.0.8 to 2.0.42. There is no fixed version available. The GitHub repository has been archived and the latest version published is 2.0.42. The patch is available for some OSs. Red Hat have patched Enterprise Linux versions 9 and 10. However, this vulnerability is rated as Important. This is because the HTTP/2 streams use separate memory allocators making it harder to exploit. Enterprise Linux 8 and below are unaffected. Debian have patched this in their unstable version. Bookworm, trixie and forky are still affected. 
Amazon Linux 2, 2023 and 2027 Preview are waiting on patches. Ubuntu do not have a specific vulnerability page.  
If you cannot patch your systems then Wiz recommend disabling HTTP/2 by removing ‘h2’ and ‘h2c’ from the Protocols directive. This will leave you with HTTP/1.1. This vulnerability was first reported by Anthropic’s OSS Scanner on the 26th October. The scanner uses Anthropic’s AI models to scan open source software. It was also reported by Anthony Weems and Simon Scannell from Google Cloud Vulnerability Research last week. This comes after another vulnerability in Apache’s HTTP/2 module (CVE-2026-23918) was patched in version 2.4.67 in May. Upgrading to this version or any version after up to 2.4.70 won’t protect your systems from this new vulnerability.
Read more »
Subscribe to: Posts (Atom)

Featured