/
attack_type:espionage × criticity:high × latest_source_host:thehackernews.com × limpar

Resultados

5 casos · pág. 1/1

thehackernews.com · high

Ex-OpenAI engineer detained over covert recording device in executive conference room; Saudi royal contacts alleged

A U.S. court on Monday granted the government's request to detain Abdulrahman Alfozan, a 35-year-old Saudi national and former OpenAI engineer, accused of planting a concealed audio recorder in an executive conference room at the company's San Francisco office. A prosecution filing says he was in frequent WhatsApp contact in 2025-2026 wit…

thehackernews.com · · 2 fontes · 2 atualizações high

BRONZE SANDCASTLE: suspected China-based cluster uses Sandboxie DLL sideloading and custom backdoors to steal ntds.dit in Asia and Africa

BRONZE SANDCASTLE (written Bronze Sandcastle by thehackernews.com) is a previously undocumented intrusion set disclosed by SophosLabs on 2026-10-21. It is assessed as China-based or China-aligned and has been active since mid-2025 (thehackernews.com). Between August 2025 and August 2026 it compromised victims in the Philippines, Taiwan, A…

Silent Lynx (UAT-6275) uses WinRAR CVE-2025-8088 and reverse shells against CIS government targets

Silent Lynx, tracked as UAT-6275 by Cisco Talos and TAG-193 by Recorded Future Insikt Group, has been linked to a new set of attacks on government organizations across the Commonwealth of Independent States. The activity ran from June 2025 through August 2026 and used four infection chains to deploy custom reverse shells (FoalShell, Chvos…

thehackernews.com · high

CL-STA-0954 exploits FortiOS CVE-2025-61624 to deploy memory-resident ARM64 implant PEERSTITCH after FortiJump breach

Palo Alto Networks Unit 42 reports that a suspected advanced actor tracked as CL-STA-0954 (aka UNC5820) deployed a previously unreported memory-resident ARM64 implant, PEERSTITCH, on Fortinet FortiGate firewalls. The group exploited the FortiOS path traversal flaw CVE-2025-61624 for the final stage. The intrusion hit a telecommunications …

thehackernews.com · high

Cyber Partisans (Partisan Zmiy) hid Vasilek backdoor in VMware Tools in two-year intrusion at Russian healthcare organization

Russian firm Solar (a Rostelecom subsidiary) reported a nearly two-year intrusion at an unnamed Russian healthcare organization, attributed to the Belarus-aligned hacktivist cluster Partisan Zmiy (Cyber Partisans). Solar found the compromise in December 2025, but the earliest signs date to early 2024. Unlike the group's usual destructive …