Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Latest News

Hackers Turn ScreenConnect Into Its Own Infection Vector in New Worm-Like Campaign

  A remote access tool built for IT departments and help desks is now being weaponized against them. Researchers at Huntress say they'v...

All the recent news you need to know
Hacker attack
Bitcoin Bitcoin Hacker Bitcoin Security Bitcoin Theft Blockchain Blockchain Security Cyber Attacks Hacker attack

Liquid Network Attacker Returns 85% of Stolen Bitcoin After Blockstream Patches Bug

 

The attacker who stole 4,000 bitcoin (BTC) from Liquid Network’s federation wallet on the weekend has returned 85% of the funds after Blockstream announced that its bridge nodes had been patched. The abovementioned white-hat hacker communicated with the exchange via Bitcoin OP_RETURN and PGP encrypted text. On block 965,875, the criminal warned Blockstream to “fix the bug first” and patch all bridge nodes before asking for the funds to be returned. 

The Blockstream representatives, led by Adam Back, informed the hacker that their bridge nodes have been patched and it was safe to return the money. The message, signed with their key, was attached to a PGP-signed on-chain note. This key was verified against the security key, published on the blockchain by Blockstream. Consequently, the hacker transferred 3,400 BTC to the federation address on block 965,950. Thus, about 598.5 BTC (or $47.3 million at the time of writing) remained in the hands of the attacker. 

In the previous message, on block 965,822, the hacker proposed to return most of the bitcoin to the federation address. Earlier, Blockstream contacted the unknown party initiating the security team. The conversation began after Liquid announced on September 6 that 4,000 BTC (about $320 million at the time) was stolen from its treasury. Notably, the SideSwap Peg-out Authorization Key was used to initiate the withdrawal, but it was not hacked. On X, SideSwap announced that the attack involved 4,000 LBTC, which the company’s peg-out service burned. 

The Liquid Federation transferred 3,996 BTC to the customer’s bitcoin address as payment for the 4,000 LBTC. According to SideSwap, the error occurred because of an “elements software issue or bug,” resulting in the creation of the 4,000 LBTC. Nevertheless, the trading platform claimed that its servers were not breached, and its peg-out authorization key was secure. Liquid Network advised to stop all blockchain activities, including the bridge, and suspended LBTC deposits and withdrawals at exchanges. 

Meanwhile, SideSwap stated that it would pause swaps, peg-ins, and peg-outs of its proof-of-reserve token until the network resumes operations. White-hat hackers are common in the cryptocurrency industry, especially when large sums of money are at risk. In most cases, crypto heists end with the attackers disappearing with a small portion of the stolen funds. However, dealing with “white hats” can be challenging for projects in many ways. 

Notably, in the past years, several projects have seen an increase in attacks, followed by negotiations about returning the majority of the hijacked crypto. Some projects even offer rewards to cryptos, threatening to take legal action if they do not provide evidence of cracking their systems. It remains unclear when Liquid Network and Blockstream will resume operations. However, until the resumption of operations, the attacker can enjoy a tidy sum of money – about $47.3 million.
Read more »
PEEP
Browser Security Chrome Backdoor Credential Theft Edge Extension malware PEEP

PEEP Turns Chrome and Edge Into Hidden Backdoors

 

Cybersecurity researchers have uncovered PEEP, a Chromium-based post-exploitation toolkit that turns Chrome and Edge into stealthy backdoors after an attacker already has access to a system. The malware poses as a bookmarks extension and uses browser trust to slip past ordinary checks. 

PEEP is built to operate after compromise rather than to break in on its own, which means it depends on some earlier intrusion or code execution step. Once installed, it injects itself into browser profiles and forges Chromium Secure Preferences values to bypass warnings, making it harder for users and defenders to notice. 

The extension continuously checks its command server for tasks and quietly sends back browsing history, active tabs, cookies, and other session details. It can also steal credentials, hijack sessions, alter web pages, and use a native-messaging helper to run host-level commands and manage files outside the browser sandbox. 

Researchers say PEEP appears to be based on RedExt, an open-source browser analysis and red-teaming framework, but it adds stronger persistence and more operational features. It uses multiple delivery and survival methods, including sideloading, enterprise force-install policies, preference tampering, and scripts such as install_silent.ps1, patch_secure_prefs.ps1, and force_enable.ps1. 

The safest response is to treat unexpected browser extensions as a serious incident signal, especially if they appear outside the Chrome Web Store or are installed through policy or sideloading. Security teams should inspect browser profiles, review extension force-install settings, monitor for suspicious native-messaging hosts, and check for abnormal outbound traffic to unknown command servers; users should keep browsers updated, remove unknown extensions, use least-privilege accounts, and report signs of session theft or credential abuse immediately.
Read more »
Vulnerabilities and Exploits
AWS Credentials CI/CD Security Cloud Security CVE-2026-63077 Cybersecurity Breach JetBrains Cadence TeamCity Vulnerability Vulnerabilities and Exploits

Attackers Exploit TeamCity Flaw to Breach JetBrains Cadence


JetBrains has revealed a security incident involving its Cadence cloud development service after attackers gained access through an unpatched TeamCity server. The compromise exposed sensitive credentials, source code, and service information, causing concerns regarding the security of development environments connected to cloud computing resources. 


During this incident, CVE-2026-63077, a critical TeamCity On-Premises vulnerability, was exploited by an unauthenticated attacker, allowing him to execute operating system commands on an affected server without any authentication. 

A flaw disclosed by JetBrains on July 27 was exploited soon after by vulnerable TeamCity installations. In the case of Cadence, it was api.cadence.jetbrains.com, the infrastructure used to support JetBrains' cloud computing service for PyCharm, which was vulnerable. 

A malicious attacker is believed to have begun attacking on August 8 JetBrains discovered the intrusion on August 23 and taken the affected server offline the following day, putting the confirmed incident window between August 8 and August 24. Cadence integrates with PyCharm through an optional plugin that provides access to cloud-based computing resources for development projects. 

As TeamCity managed those workloads behind the service, the compromised system was part of a closely related environment involving software development and execution. JetBrains acknowledged that the server should have been patched immediately following the disclosure of the TeamCity vulnerability, but remained unpatched. 

Following the discovery of the critical vulnerability in TeamCity, the company has previously advised organizations to update vulnerable TeamCity deployments. In addition, the breach became more significant because attackers obtained a complete backup of Cadence server data from 2024. In addition, JetBrains confirmed that several Amazon Web Services IAM users and their credentials were compromised, including those belonging to Cadence employees. 

The backup may contain credentials, configuration data, artifacts, and logs. A compromised backup contained more than routine service data. It also contained configuration information and credentials associated with cloud and development resources. Researchers also discovered that JetBrains customers' own buckets were accessed through S3 buckets within JetBrains' Amazon Web Services environment. 

The extent of customer access to these buckets is unknown. There were several aspects of the development infrastructure exposed, including access to AWS IAM accounts, source-control access, package and container registry credentials, API tokens, SSH and deployment keys, service accounts and signing credentials, among others. 

In the event of valid credentials remaining after the compromise, such access could provide a path into connected systems. JetBrains has not identified a specific threat actor as responsible for the activity, and no custom malware has been identified. Instead of exploiting a TeamCity vulnerability, the attacker used legitimate credentials and cloud services to conduct the intrusion. This method can make it difficult to distinguish malicious activity from normal administrative activity. This incident demonstrates the security implications of continuous integration and continuous delivery. 

Using TeamCity environments, you can access source repositories, build artifacts, deployment systems, package registries, and cloud resources. Thus, a compromise on this level can lead to credential theft, unauthorized changes, and software supply chain attacks beyond the affected server. According to JetBrains, access tokens for the Cadence plugin in PyCharm have been invalidated, and users are encouraged to revoke or rotate credentials and secrets that were potentially used during Cadence executions. 

In addition, Cadence inputs and outputs derived from this period should be viewed as potentially untrusted. As a result of the TeamCity vulnerability, a CVSS score of 9.8 has been assigned to it; it affects on-premises installations not updated to the latest version. The JetBrains patch version 2025.11.7 and version 2026.1.3, along with a security patch plugin, are available for environments in which immediate upgrades are not possible. 

After exploitation was observed in the wild, CISA added the flaw to its catalog of Known Exploited Vulnerabilities. JetBrains has begun to assess the impact of the Cadence breach and has prompted a broader review of the affected environment. Upon completing the investigation, the company will contact affected users if further information is discovered that requires action. 

According to the company, the incident is limited to the data associated with the Cadence host identified. It illustrates how critical it is to keep the CI/CD infrastructure patched, particularly when development systems are connected to the cloud and sensitive credentials.
Read more »
WinUpdate
LockAPPHost malware ProManager REVSTEALER SoftManager Windows WinUpdate

REVSTEALER Malware Disables Windows Security to Run a Crypto Miner


A new malware campaign associated with the REVSTEALER information stealing malware has been discovered using another four additional malicious programs to secretly mine cryptocurrency, steal cryptocurrency data, and maintain access to compromised Windows systems.

About the malware

As per Elastic Security Labs, the four programs are called LockAppHost, SoftManager, WinUpdate, and ProManager. 

Experts found that the components can stay on a computer even when REVSTEALER removes itself. This makes the compromise hard to locate and stop. 

“Unlike most commodity stealers, REVSTEALER seems to put more effort into validating its targets; this is evident in its cryptocurrency wallet harvester, which uses a multi-layer architecture with a discovery engine followed by a collector that applies wallet-specific extension filters to extract only relevant files,” Elastic Security Labs reported.

What does REVSTEALER do?

Available as a commercial malware since February 2026, REVSTEALER is a rising Windows information stealer. It can store browser cookies and passwords, messaging data, cryptocurrency wallet details, files from compromised systems, and gaming accounts. Once the information is stolen, the primary malware deletes itself, which results in making the computer look legitimate. 

But the four newly discovered programs work distinctly as they can remain on the target's computers by installing themselves.

The four malicious programs

LockAppHost

LockAppHost is the most disruptive component, because before launching a cryptocurrency miner, it can disable Windows security.

SoftManager

SoftManger turns a compromised system into a reverse proxy. This permits threat actors to direct their network traffic via the target’s internet connection, possibly covering the tracks of the threat actor’s real location. 

WinUpdate

WinUpdate surveys the Windows clipboard. The malware can replace the addresses controlled by attackers when a user copies cryptocurrency wallet addresses. This may send cryptocurrency payments to the threat actors

ProManager

Cryptocurrency wallets are the main focus of this program. ProManager can steal browser wallet extensions and wallet files. Experts also discovered that the program can show attacker-controlled content over genuine cryptocurrency wallet apps and store passphrases and passwords typed by users.

LockAppHost shuts down windows security

LockAppHost can get admin privileges to make major changes in the Windows system, Elastic found. 

LockAppHost can also disable five Windows Update services, impact Microsoft Defender, turn off two malware-removal tasks, and shut down 11 scheduled update tasks. It launches a cryptocurrency miner after compromising the computer’s security features. 

The miner makes it difficult to detect for users to find out malicious operations and for security software to detect by hiding inside authenticated Windows processes.

Read more »
Vadodara
Attack vendors Cross Border Cybercrime Cyber Fraud Email scam Email Spoofing Vadodara

Vadodara Businessman Duped of Rs 19.75 Lakh in Fake Supplier Email Scam

 



A city-based businessman lost close to Rs 20 lakh after fraudsters hijacked his correspondence with a Dubai supplier and rerouted a payment meant for a shipment of doors and windows into their own account.

Indrajit Basu, 32, has told the Cyber Crime police station that the fraud unfolded over nearly two months, between May 25 and July 13 this year. Basu had placed an order for material with True Sea Services FZC, a Dubai-based company, after reaching out to the firm through its website and official email address. He sent an advance of $11,216.21 through SWIFT on March 10 to the company's genuine bank account, and the order moved ahead as planned.

The trouble started while the goods were still being readied. Police say an unidentified person created a near-identical email address, swapping the supplier's genuine inquiry@trusea.ae for inquiry@trusea-ae.com, a domain close enough to pass an unhurried glance. Messages sent from this lookalike address, still carrying the True Sea Services name, informed Basu that the company's bank details had changed. In their place was an account said to belong to First Abu Dhabi Bank PJSC, complete with an IBAN number and a listed branch address.

Basu had no reason to doubt the communication and processed the documentation for the balance payment accordingly. On June 9, he wired $20,830, roughly Rs 19.75 lakh at the time, to the new account. The money never reached the actual supplier, and repeated follow-ups brought no resolution, at which point Basu approached the police.

The Cyber Crime police registered a complaint on Thursday night under relevant sections of the Bharatiya Nyaya Sanhita and the Information Technology Act. The named accused include whoever operated the fraudulent email address, the person who holds and controls the bank account that received the transfer, and others believed to have taken part in the conspiracy. Investigators are working to trace the account holder and the digital trail left by the spoofed domain.

Basu's case falls squarely into the bracket Gujarat Police now treats as serious enough to route away from local stations. Under a restructuring the state carried out this year, complaints involving losses above Rs 10 lakh are handled exclusively by dedicated Cyber Crime Police Stations rather than the jurisdictional police, precisely because cases of this size tend to involve cross-border transfers and mule accounts that local units are not equipped to trace.

The scale of the problem in Gujarat gives that decision some context. State figures put cumulative cyber fraud losses at around Rs 3,707 crore, with roughly Rs 1,435 crore of that lost in 2025-26 alone, and only about 3 percent of the total has been recovered so far. Police have leaned on what they call the golden hour, the narrow window right after a fraudulent transfer in which a call to the national helpline, 1930, or a report on the National Cyber Crime Reporting Portal can still get an account frozen before the money is moved on. Gujarat Police's Operation Mule Hunt, which wrapped up its first phase in June, flagged more than 900 mule accounts and led to over 600 arrests, stressing how heavily this kind of fraud depends on layers of accounts opened specifically to receive and quickly disperse stolen funds.

The method used against Basu, a lookalike domain slipped into an active supplier conversation, is what cybersecurity researchers classify as vendor email compromise, a variant of the broader business email compromise problem that the FBI's Internet Crime Complaint Center logged at nearly 25,000 complaints and just over $3 billion in reported losses in the US alone in 2025, both figures higher than the year before. Security researchers who track these schemes note that attackers increasingly avoid tipping off a target with an urgent, out-of-context demand for money. Instead they wait inside a live, legitimate transaction, often after quietly monitoring an inbox for weeks, and strike only when a payment is already due, using a domain that differs from the original by a hyphen, an extra letter or a swapped top-level domain, easy to miss on a quick read. Investigators and bank officials advise businesses dealing with overseas suppliers to treat any mid-transaction change in payment or account details as a red flag, and to confirm such changes only through a phone number sourced independently of the email itself, rather than one supplied in the message.

Read more »
Network Patches
ArubaOS-CX Vulnerabilities and Exploits Cyber Advisory HPE Security Network Patches

HPE Patches Multiple ArubaOS-CX Vulnerabilities

 

Hewlett Packard Enterprise has released a security advisory for Aruba Networking ArubaOS-CX, warning customers about multiple vulnerabilities affecting the switch operating system. The advisory, published on September 1, 2026, says HPE has issued updates to address the issues and urges administrators to review their deployments promptly. 

According to the advisory and related vulnerability listings, the flaws span several categories. Some issues can expose sensitive information through API endpoints, while others may allow denial of service, stored cross-site scripting, arbitrary file write behavior, or path traversal under certain conditions. The breadth of the report suggests that both the management interface and backend API paths were part of the security review. 

The most serious concerns are likely to be those that could let an authenticated attacker influence device behavior or reach deeper system components. One vulnerability involves an API endpoint that could allow a low-privilege authenticated operator to change certain settings, while another points to stored XSS in the web-based management interface. Other disclosures describe file-writing and traversal weaknesses that may, in some cases, lead to remote code execution or broader system compromise. 

For enterprise users, the practical takeaway is simple: check which ArubaOS-CX version is deployed and compare it with the affected branches listed in public vulnerability records. Network administrators should prioritize patching, especially on systems used for core switching, segmentation, and centralized management. HPE’s release indicates that updates are available, making this a straightforward remediation case rather than a purely advisory-only notice. 

Organizations using ArubaOS-CX should treat the bulletin as a reminder to keep network infrastructure current. Security gaps in switching platforms can have wider consequences than a single device issue, especially when they involve administrative interfaces and API access. Applying the vendor update and validating exposure across affected versions are the most important next steps.
Read more »
Subscribe to: Posts (Atom)

Featured