4 casos · pág. 1/1
Varonis Threat Labs disclosed a privilege-escalation chain in Snowflake Postgres that turned a limited, non-superuser role (snowflakeadmin, holding CREATEROLE) into operating-system command execution as the postgres account. The chain abused built-in PostgreSQL behaviors, even though Snowflake had blocked the usual SQL-to-OS routes. Varon…
Recorded Future's Insikt Group (report of October 16) tracks a suspected Chinese-speaking actor, TAG-217, linked to attacks on South Korean financial institutions. The actor used Claude Code, DeepSeek, Grok and Zhipu AI alongside ARTEX, an open-source Chinese-language AI penetration testing framework. Public reporting cited in the investi…
Acronis Threat Research Unit found that the Gentlemen ransomware operation is using the BYOVD (bring your own vulnerable driver) technique with legitimate Lenovo and Safetica kernel drivers to terminate endpoint security software before encrypting files. Two custom dropper samples were recovered from a recent incident. They install the dr…
SOCRadar's Threat Research Unit (STRU) found open directories on 45.227.254.43 in late September 2026. They led to six more adversary servers tied to INC Ransom and The Gentlemen affiliates. The servers held 8,257 AI messages across 133 sessions, source code, stolen credentials, victim workspaces and 46 victim-specific INC encryptor build…
