Information

19 Aug

Oregon Man Charged in ‘Rapper Bot’ DDoS Service

Information, Insights

A 22-year-old Oregon man has been arrested on suspicion of operating “Rapper Bot,” a massive botnet used to power a service for launching distributed denial-of-service (DDoS) attacks against targets — including a March 2025 DDoS that knocked Twitter/X offline. The Justice Department asserts the suspect and an unidentified co-conspirator rented out the botnet to online extortionists, and tried to stay off the radar of law enforcement by ensuring that their botnet was never pointed at…

Read More
15 Aug

Mobile Phishers Target Brokerage Accounts in ‘Ramp and Dump’ Cashout Scheme

Information, Insights

Cybercriminal groups peddling sophisticated phishing kits that convert stolen card data into mobile wallets have recently shifted their focus to targeting customers of brokerage services, new research shows. Undeterred by security controls at these trading platforms that block users from wiring funds directly out of accounts, the phishers have pivoted to using multiple compromised brokerage accounts in unison to manipulate the prices of foreign stocks. Image: Shutterstock, WhataWin. This so-called ‘ramp and dump‘ scheme borrows…

Read More
14 Aug

Vulnerabilities in Xerox Print Orchestration Product Allow Remote Code Execution

Information, News

Two serious vulnerabilities were patched recently by Xerox in its FreeFlow Core print orchestration platform.  According to pentesting company Horizon3, whose researchers discovered the flaws, FreeFlow Core is affected by an XXE injection flaw (CVE-2025-8355) and a path traversal issue (CVE-2025-8356). The researchers discovered that the vulnerabilities could allow an unauthenticated, remote attacker to execute arbitrary code on affected FreeFlow Core instances. The potential impact has been demonstrated with an exploit that placed a webshell…

Read More
14 Aug

How the always-on generation can level up its cybersecurity game

Information

Kids Online Digital natives are comfortable with technology, but may be more exposed to online scams and other threats than they think Phil Muncaster 12 Aug 2025  •  , 5 min. read It’s International Youth Day on August 12, a moment to celebrate the contribution of young people to society. A big part of this contribution is digital, according to the United Nations, which also notes that “young people are leading the charge in digital…

Read More
14 Aug

Supply-chain dependencies: Check your resilience blind spot

Information

Business Security Does your business truly understand its dependencies, and how to mitigate the risks posed by an attack on them? Tony Anscombe 12 Aug 2025  •  , 4 min. read A panel discussion at DEF CON 33 last week, titled “Adversaries at war: Tactics, technologies, and lessons from modern battlefields”, offered several thought-provoking points, as well as a clear takeaway: while digital tactics such as misinformation and influence campaigns are useful in modern conflict,…

Read More
12 Aug

Microsoft Patch Tuesday, August 2025 Edition

Information, Insights

Microsoft today released updates to fix more than 100 security flaws in its Windows operating systems and other software. At least 13 of the bugs received Microsoft’s most-dire “critical” rating, meaning they could be abused by malware or malcontents to gain remote access to a Windows system with little or no help from users. August’s patch batch from Redmond includes an update for CVE-2025-53786, a vulnerability that allows an attacker to pivot from a compromised…

Read More
12 Aug

Update WinRAR tools now: RomCom and others exploiting zero-day vulnerability

Information

ESET researchers have discovered a previously unknown vulnerability in WinRAR, being exploited in the wild by Russia-aligned group RomCom. This is at least the third time that RomCom has been caught exploiting a significant zero-day vulnerability in the wild. Previous examples include the abuse of CVE-2023-36884 via Microsoft Word in June 2023, and the combined vulnerabilities assigned CVE‑2024‑9680 chained with another previously unknown vulnerability in Windows, CVE‑2024‑49039, targeting vulnerable versions of Firefox, Thunderbird, and the…

Read More
12 Aug

WinRAR zero-day exploited in espionage attacks against high-value targets

Information

The attacks used spearphishing campaigns to target financial, manufacturing, defense, and logistics companies in Europe and Canada, ESET research finds 11 Aug 2025 ESET researchers have uncovered a previously unknown vulnerability in WinRAR, actively being exploited by Russia-aligned group RomCom. Tracked as CVE-2025-8088, the path traversal flaw affects WinRAR’s Windows version and lets threat actors execute arbitrary code by crafting malicious archive files. This marks at least the third time RomCom has leveraged a significant…

Read More
10 Aug

Android adware: What is it, and how do I get it off my device?

Information

Mobile Security Is your phone suddenly flooded with aggressive ads, slowing down performance or leading to unusual app behavior? Here’s what to do. Phil Muncaster 08 Aug 2025  •  , 5 min. read There are various bad things that could end up on your smartphone. Spyware designed to turn your phone into a secret surveillance device. Trojans that could harvest your banking logins or credit card data, possibly via a novel method that relays NFC…

Read More
10 Aug

Black Hat USA 2025: Is a high cyber insurance premium about your risk, or your insurer’s?

Information

Business Security A sky-high premium may not always reflect your company’s security posture Tony Anscombe 08 Aug 2025  •  , 3 min. read When a cyber risk insurance quote lands on your desk and the premium is sky high, it’s natural to assume that the insurer is judging your environment to be high risk. So, when the next quote lands and is more acceptable, does it mean they viewed your risk differently? According to one…

Read More