Over Security

Cyble weekly vulnerability report tracked 1,960 vulnerabilities and 10 ICS flaws this week, with 248 PoCs and KEV additions.

Solo affrontando congiuntamente i tre pilastri - hardware, persone e standard - sarà possibile passare dall'era sperimentale a quella del robusto vantaggio quantistico resistente agli errori. Ecco cos'è e le prospettive future del calcolo quantistico

Bitcoin Depot, which operates one of the largest Bitcoin ATM networks, says attackers stole $3.665 million worth of Bitcoin from its crypto wallets after breaching its systems last month.

Bitcoin Depot cyberattack remains under investigation, with third-party cybersecurity specialists continuing to analyze the scope of the intrusion.

Microsoft has suspended developer accounts used to maintain multiple high-profile open-source projects without proper notification and no way to quickly reinstate them, effectively blocking them from publishing new software builds and security patches for Windows users.

A ClickFix-style macOS attack uses Script Editor and an Apple-themed webpage to bypass Terminal protections and deliver malware.

The Eurail data breach highlights the risks associated with large-scale travel platforms that handle sensitive identity and financial information.

A massive campaign impacting nearly 100 online stores using the Magento e-commerce platform hides credit card-stealing code in a pixel-sized Scalable Vector Graphics (SVG) image.

A threat actor tracked as UNC6783 is compromising business process outsourcing (BPO) providers to gain access to high-value companies across multiple sectors.

Security researchers exposed a spying campaign by a hack-for-hire group that used Android spyware and phishing to steal iCloud credentials and hack victims’ devices.

A new campaign delivering the Atomic Stealer malware to macOS users abuses the Script Editor in a variation of the ClickFix attack that tricked users into executing commands in Terminal.

CISA has given U.S. government agencies four days to secure their systems against a critical-severity vulnerability in Ivanti Endpoint Manager Mobile (EPMM) that has been exploited in attacks since January.

Security researchers discovered a remote code execution (RCE) vulnerability in Apache ActiveMQ Classic that has gone undetected for 13 years and could be exploited to execute arbitrary commands.

È stata ribattezzata Operation NoVoice la campagna malevola per la distruzione di malware Android che prende di mira smartphone non aggiornati sfruttando vulnerabilità già note e corrette nei dispositivi più recenti. L’obiettivo è il controllo completo del sistema colpito. Ecco tutti i dettagli

The LAPD said the breach affected “a digital storage system” belonging to the city’s Attorney's Office. The World Leaks extortion gang was reported to be behind the attack.

Per comprendere la portata della sfida, è utile inquadrarla nel contesto attuale della sicurezzainformatica. Ecco quali vantaggi porta Anthropic Claude Mythos Preview nella cyber security

Il rapporto Cisco Talos 2025 Year in Review offre un'analisi di tattiche, tecniche e procedure che hanno caratterizzato le operazioni degli hacker a livello globale. Ne emerge un ecosistema in cui la velocità di reazione dei difensori è inferiore a quella degli attaccanti, e dove l'identità digitale è il bersaglio primario di ogni campagna offensiva

Dalla compromissione iniziale alla monetizzazione: le credenziali diventano l’asset più prezioso nel cybercrime globale. Ecco come le aziende devono ripensare completamente le strategie di difesa, mentre il mercato nero degli accessi cloud privilegiati vola oltre i 15.000 dollari a credenziale sottratta

L'NCSC del Regno Unito ha dichiarato che il gruppo informatico statale russo APT28, un'unità dell'intelligence militare russa, ha sfruttato router Internet vulnerabili per consentire operazioni di dirottamento del sistema DNS. Obiettivo: intercettare il traffico e rubare password e dati di accesso

L’annuncio di Anthropic sembrerebbe una trovata di marketing se non fosse che per il momento hanno effettivamente deciso di non vendere il servizio basato sul loro ultimo modello Claude Mythos Preview. La società ha infatti deciso di limitare l’accesso a Claude Mythos Preview a un consorzio ristretto di aziende e organizzazioni, nel tentativo di anticipare …

A $30,000 AI GPU doesn't outperform consumer GPUs at password cracking. Specops explains why attackers don't need exotic hardware to break weak passwords.

This is the story of an intrusion that moved from initial access to credential harvesting in a single session, and how Binary Defense stopped it before ransomware was ever deployed. What began as a routine endpoint alert escalated into a multi-host compromise involving unauthorized remote access, privilege escalation attempts, and credential harvesting activity. The attacker leveraged a legitimate remote support platform to blend into normal operations, deployed secondary access tooling, and attempted to stage credential dumping utilities, including NetExec (nxc) with LSASS-focused capabilities. While no ransomware was ultimately deployed, the observed behavior strongly aligned with pre-ransomware tradecraft, including: Establishment of persistent remote access Internal reconnaissance and security tool enumeration Local administrator creation attempts Credential access preparation via LSASS tooling Binary Defense identified the activity early, escalated within minutes, and coordinated containment actions that prevented lateral movement and potential ransomware deployment. In this case, the intrusion originated from the compromise of an internet-facing SimpleHelp technician account, providing the attacker with authenticated access to a legitimate remote support platform. Secondary Remote Access via MeshCentral Installed via mac.exe --fullinstall Deployed MeshAgent.exe Created scheduled task (MeshUserTask) Established outbound communication to attacker-controlled infrastructure This provided a redundant access channel, or better put, insurance against losing the compromised SimpleHelp account if it was discovered and revoked. Local Administrative Account Creation The attacker attempted to create a local account (support) and add it to the Administrators group: net user support /add net localgroup administrators support /add Two independent footholds, both established before any significant movement2 Same Playbook, New Hosts While Binary Defense was coordinating with the client on response, the attacker used their access via the compromised SimpleHelp account to reach additional systems. The Inflection Point Following persistence and discovery, the attacker attempted to transition into credential access by deploying nxc.exe, identified as NetExec with LSASS-focused capabilities. At this stage, Binary Defense had observed the intrusion progress through access, persistence, and discovery and was confident the full attack path was understood, enabling targeted containment actions that removed the attacker's access entirely. Remote access turned into persistence within minutes. Discovery moved directly toward credential access. The attacker had access, persistence, and a solid understanding of the environment. Phase Behavior Detection Opportunity Initial Access Authenticated RMM access from unusual source or off-hours Baseline normal authentication patterns; alert on anomalous source geography or login time Persistence MeshCentral installation via command line (mac.exe --fullinstall) Alert on installation of unapproved RMM tooling; monitor for MeshAgent.exe process creation Persistence Scheduled task creation for MeshUserTask Monitor scheduled task creation (Event ID 4698) for non-standard task names Persistence New local account creation followed immediately by admin group addition Alert on net user /add and net localgroup administrators executed in close sequence Discovery wmic AntiVirusProduct query Flag AV enumeration queries, particularly when preceded by a remote session Discovery nltest /dclist outside of known admin tooling Alert on domain controller enumeration from non-standard processes or user accounts Lateral Movement Repeated persistence sequence across multiple hosts in a single session window Correlate MeshAgent installations and local account creation events across hosts Privilege Escalation nxc.exe / NetExec execution targeting LSASS Block or alert on LSASS-targeting credential dumping tools; monitor for NetExec process patterns Broader recommendation: Invest in behavioral correlation across the persistence ph

Here’s how agentic AI architecture powering dual-brain cybersecurity with predictive insights, autonomous response, and real-time threat defense.