New Backdoor Targets French Entities via Open-Source Package Installer

Researchers have exposed a new targeted email campaign aimed at French entities in the construction, real estate, and government sectors that leverages the Chocolatey Windows package manager to deliver a backdoor called Serpent on compromised systems. Enterprise security firm Proofpoint attribute...

The Lapsus$ Hacking Group Is Off to a Chaotic Start

Telegram polls. Unusual demands. The latest extortion gang is on an unorthodox rampage...

Lnkbomb - Malicious Shortcut Generator For Collecting NTLM Hashes From Insecure File Shares

Lnkbomb is used for uploading malicious shortcut files to insecure file shares. The vulnerability exists due to Windows looking for an icon file to associate with the shortcut file. This icon file can be directed to a penetration tester's machine running Responder or smbserver to gather NTLMv1 or...

Gaming Company Ubisoft Confirms It was Hacked, Resets Staff Passwords

French video game company Ubisoft on Friday confirmed it was a victim of a "cyber security incident," causing temporary disruptions to its games, systems, and services. The Montreuil-headquartered firm said that an investigation into the breach was underway and that it has initiated a company-wid...

Cyber Security Incident Pushes Ubisoft to Issue Internal Password Reset

By Deeba Ahmed It is unclear what type of "Cyber Security Incident" Ubisoft suffered but on Telegram LAPSUS$ hacking group responded… This is a post from HackRead.com Read the original post: Cyber Security Incident Pushes Ubisoft to Issue Internal Password Reset...

Is Hacktivism Good or Bad? How Could It Affect Your Business?

By Owais Sultan When the term hacktivism is discussed the first thing that comes to our mind is the Anonymous collective.… This is a post from HackRead.com Read the original post: Is Hacktivism Good or Bad? How Could It Affect Your Business?...

Critical Bugs in TerraMaster TOS Could Open NAS Devices to Remote Hacking

Researchers have disclosed details of critical security vulnerabilities in TerraMaster network-attached storage TNAS devices that could be chained to attain unauthenticated remote code execution with the highest privileges. The issues reside in TOS, an abbreviation for TerraMaster Operating Syste...

75% of Tested Smart Infusion Pumps Vulnerable to Hacking

By Deeba Ahmed As of 2020, about 80% of hospitals in the United States were using smart infusion pumps. Palo Alto… This is a post from HackRead.com Read the original post: 75% of Tested Smart Infusion Pumps Vulnerable to Hacking...

Details of an NSA Hacking Operation

Pangu Lab in China just published a report of a hacking operation by the Equation Group aka the NSA. It noticed the hack in 2013, and was able to map it with Equation Group tools published by the Shadow Brokers aka some Russian group. …the scope of victims exceeded 287 targets in 45 countries,...

Break into Ethical Hacking with 18 Advanced Online Courses for Just $42.99

It is predicted that 3.5 million jobs will be unfilled in the field of cybersecurity by the end of this year. Several of these jobs pay very well, and in most cases, you don't even need a college degree to get hired. The most important thing is to have the skills and certifications. The All-In-On...

Chinese Experts Uncover Details of Equation Group's Bvp47 Covert Hacking Tool

Researchers from China's Pangu Lab have disclosed details of a "top-tier" backdoor put to use by the Equation Group, an advanced persistent threat APT with alleged ties to the cyber-warfare intelligence-gathering unit of the U.S. National Security Agency NSA. Dubbed "Bvp47" owing to numerous...

Dbltek GoIP - Local File Inclusion Vulnerability

Exploit Title: Dbltek GoIP - Local File Inclusion Exploit Author: Valtteri Lehtinen & Lassi Korhonen Vendor Homepage: http://en.dbltek.com/index.html Software Link: - Version: GHSFVT-1.1-67-5 firmware version Tested on: Target is an IoT device Exploit summary Dbltek GoIP-1 is a VoIP-GSM gateway...

Man pleads guilty to selling WhatsApp hacking tool, Signal Jammers & StingRays

By Waqas Carlos Guerrero, a prominent businessman marketed and sold hacking tools, IMSI catchers, and other malicious tools to clients… This is a post from HackRead.com Read the original post: Man pleads guilty to selling WhatsApp hacking tool, Signal Jammers & StingRays...

Ban Pegasus spyware, urges European Union Data Protection Supervisor

The European Data Protection Supervisor EDPS has urged the EU to ban the development and deployment of spyware with the capabilities of Pegasus to protect fundamental rights and freedoms. What is Pegasus? On July 18, a group of 17 newspaper and media organizations—aided by Amnesty International’s...

Kali Linux 2022.1 - Penetration Testing and Ethical Hacking Linux Distribution

Time for another Kali Linux release! – Kali Linux 2022.1. This release has various impressive updates. The summary of the changelog since the 2021.4 release from December 2021 is: Visual Refresh - Updated wallpapers and GRUB theme Shell Prompt Changes - Visual improvements to improve readability...

Security Software Developer – Job Description and How to Become One

Introduction The cybersecurity industry is daily growing bigger daily and creating numerous roles for anyone to specialize in. One of the eye-catching perks of the industry is the annual pay which varies according to the role. This guide focuses on teaching a security software developer job...

Hackers Planted Fake Digital Evidence on Devices of Indian Activists and Lawyers

A previously unknown hacking group has been linked to targeted attacks against human rights activists, human rights defenders, academics, and lawyers across India in an attempt to plant "incriminating digital evidence." Cybersecurity firm SentinelOne attributed the intrusions to a group it tracks...

"Zero-Days" Without Incident - Compromising Angular via Expired npm Publisher Email Domains

NOTE: If you’re just looking for the high level points, see the “The TL;DR Summary & High-Level Points” section of this post. Recently I took an interest in the npm registry due to it’s critical role in the security of managing packages for all of JavaScript and Node. After registering an account...

SocialPwned - An OSINT Tool That Allows To Get The Emails, From A Target, Published In Social Networks Such As Instagram, Linkedin And Twitter To Find Possible Credentials Leaks In PwnDB Or Dehashed And Obtain Google Account Information Via GHunt

SocialPwned is an OSINT tool that allows to get the emails, from a target, published in social networks like Instagram, Linkedin and Twitter to find the possible credential leaks in PwnDB or Dehashed and obtain Google account information via GHunt. The purpose of this tool is to facilitate the...

Microsoft Uncovers New Details of Russian Hacking Campaign Targeting Ukraine

Microsoft on Friday shared more of the tactics, techniques, and procedures TTPs adopted by the Russia-based Gamaredon hacking group to facilitate a barrage of cyber espionage attacks aimed at several entities in Ukraine over the past six months. The attacks are said to have singled out government...