Recently active topics

Anyone else see this issue and hopefully have a work around:When I mount a DMG disk image, or plug in a USB drive to my MacBookPro, I cannot eject it because I am told one or more  programs may be using it. This even happens if NO programs are shown as running. I have noted that if I quit WSA (shut it down) I can then eject these drives  But WSA scanning the drives  it seems leaves some process open that still has an active pin to the drives.  I do not want to force eject an HD, or even a DMG as it can damage the image or drive. Suggestions anyone? (FYI: Webroot Customer Service suggested I shut down WSA, eject the drive, and then turn it back on. WORST SOLUTION EVER.) 

December 4, 2025 By Bill Toulas The Predator spyware from surveillance company Intellexa has been using a zero-click infection mechanism dubbed “Aladdin,” which compromised specific targets by simply viewing a malicious advertisement.This powerful and previously unknown infection vector is meticulously hidden behind shell companies spread across multiple countries, now uncovered in a new joint investigation by Inside Story, Haaretz, and WAV Research Collective.The investigation is based on 'Intellexa Leaks' - a collection of leaked internal company documents and marketing material, and is corroborated by technical research from forensic and security experts at Amnesty International, Google, and Recorded Future.Leaked Intellexa marketing materialSource: Amnesty International >>Full Article<<

And then they asked an AI to help cover their tracks December 4, 2025 By Jessica Lyons Vetting staff who handle sensitive government systems is wise, and so is cutting off their access the moment they're fired. Prosecutors say a federal contractor learned this the hard way when twin brothers previously convicted of hacking-related offenses allegedly used lingering access to delete nearly 100 government databases, including systems tied to Homeland Security and other agencies, within minutes of being terminated.The siblings allegedly hatched the plan during the call in which they were being fired, and asked an AI to help them cover their tracks.Brothers Muneeb and Sohaib Akhter, both 34, of Alexandria, Virginia, were indicted on November 13 for conspiring to delete databases used to store US government information. They both worked as federal contractors for a company that's identified as "company 1" in the court documents [PDF]. According to an earlier Bloomberg report, it's Opexus, a

Related topics:Incident Detection, Response, and Prevention, Cyber Threats and Advisories, Malware, Phishing, and Ransomware The Cybersecurity and Infrastructure Security Agency (CISA) is aware of ongoing intrusions by People’s Republic of China (PRC) state-sponsored cyber actors using BRICKSTORM malware for long-term persistence on victim systems. BRICKSTORM is a sophisticated backdoor for VMware vSphere1,2 and Windows environments.3 Victim organizations are primarily in the Government Services and Facilities and Information Technology Sectors. BRICKSTORM enables cyber threat actors to maintain stealthy access and provides capabilities for initiation, persistence, and secure command and control. The malware employs advanced functionality, including multiple layers of encryption (e.g., HTTPS, WebSockets, and nested TLS), DNS-over-HTTPS (DoH) to conceal communications, and a SOCKS proxy to facilitate lateral movement and tunneling within victim networks. BRICKSTORM also incorporates lon

CISA released nine Industrial Control Systems (ICS) Advisories. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-338-01 Mitsubishi Electric GX Works2 ICSA-25-338-02 MAXHUB Pivot ICSA-25-338-03 Johnson Controls OpenBlue Mobile Web Application for OpenBlue Workplace ICSA-25-338-04 Johnson Controls iSTAR ICSA-25-338-05 Sunbird DCIM dcTrack and Power IQ ICSA-25-338-06 SolisCloud Monitoring Platform ICSA-25-338-07 Advantech iView ICSA-25-148-03 Consilium Safety CS5000 Fire Panel (Update A) ICSA-25-219-02 Johnson Controls FX Server, FX80 and FX90 (Update A) CISA encourages users and administrators to review newly released ICS Advisories for technical details and mitigations. This product is provided subject to this Notification and this Privacy & Use policy.VendorMitsubishi Electric Johnson Controls Advantech https://www.cisa.gov/news-events/alerts/2025/12/04/cisa-releases-nine-industrial-control-systems-adv

December 3, 2025 By Lawrence Abrams Financial software provider Marquis Software Solutions is warning that it suffered a data breach that impacted dozens of banks and credit unions across the US.Marquis Software Solutions provides data analytics, CRM tools, compliance reporting, and digital marketing services to over 700 banks, credit unions, and mortgage lenders.In data breach notifications filed with US Attorney General offices, Marquis says it suffered a ransomware attack on August 14, 2025, after its network was breached through its SonicWall firewall.This allowed the hackers to steal "certain files from its systems" during the attack."The review determined that the files contained personal information received from certain business customers," reads a notification filed with Maine's AG office."The personal information potentially involved for Maine residents includes names, addresses, phone numbers, Social Security numbers, Taxpayer Identification Numbers, financial account inform

December 4, 2025 By Lorenzo Franceschi-Bicchierai Spyware maker Intellexa had remote access to some of its government customers’ surveillance systems, giving company staffers the ability to see the personal data of people whose phones had been hacked with its Predator spyware, according to new evidence published by Amnesty International. On Thursday, Amnesty and a coalition of media partners, including Israeli newspaper Haaretz, Greek news site Inside Story, and Swiss outlet Inside IT, published a series of reports based on leaked material from Intellexa, including internal company documents, sales and marketing material, and training videos. Perhaps the most striking revelation is that people working at Intellexa could allegedly remotely access the surveillance systems of at least some of its customers via TeamViewer, an off-the-shelf tool that allows users to connect to other computers over the internet.The remote access is shown in a leaked training video revealing privileged parts

Hackers stole the names, addresses, Social Security numbers, and financial and medical information of 9,542 people. December 4, 2025 By Ionut Arghire Pharmaceutical company Inotiv is notifying over 9,500 individuals that their personal information was stolen in a data breach resulting from a ransomware attack.The incident occurred on August 8 and was blamed for causing disruptions to certain business operations and for preventing access to certain networks and systems, including internal data storage.In a December 3 filing with the US Securities and Exchange Commission (SEC), the company revealed that it has restored access to its network and systems, and that its investigation into the matter has concluded.“Between approximately August 5-8, 2025, a threat actor gained unauthorized access to the company’s systems and may have acquired certain data,” Inotiv said.In a filing with the Maine Attorney General’s Office, the company revealed that the hackers stole personal, financial, and hea

December 4, 2025 By Sergiu Gatlan The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned network defenders of Chinese hackers backdooring VMware vSphere servers with Brickstorm malware.In a joint malware analysis report with the National Security Agency (NSA) and Canada's Cyber Security Centre, CISA says it analyzed eight Brickstorm malware samples.These samples were discovered on networks belonging to victim organizations, where the attackers specifically targeted VMware vSphere servers to create hidden rogue virtual machines to evade detection and steal cloned virtual machine snapshots for further credential theft.As noted in the advisory, Brickstorm uses multiple layers of encryption, including HTTPS, WebSockets, and nested TLS to secure communication channels, a SOCKS proxy for tunneling and lateral movement within compromised networks, and DNS-over-HTTPS (DoH) for added concealment. To maintain persistence, Brickstorm also includes a self-monitoring function that

By Cara Lin | December 04, 2025 Affected Platforms: Microsoft WindowsImpacted Users: Microsoft WindowsImpact: The stolen information can be used for future attacksSeverity Level: High UDPGangster is a UDP-based backdoor associated with the MuddyWater threat group, which is known for its cyber espionage operations across the Middle East and neighboring regions. This malware enables remote control of compromised systems by allowing attackers to execute commands, exfiltrate files, and deploy additional payloads—all communicated through UDP channels designed to evade traditional network defenses.FortiGuard Labs recently observed multiple UDPGangster campaigns targeting users in Turkey, Israel, and Azerbaijan. These campaigns primarily deliver their malware through malicious Microsoft Word documents that are embedded with VBA macros, which execute the payload once the macros are enabled. The samples collected include sophisticated anti-analysis techniques to detect and evade virtual environ

Dec 04, 2025 Ravie Lakshmanan Cybersecurity / Hacking NewsThink your Wi-Fi is safe? Your coding tools? Or even your favorite financial apps? This week proves again how hackers, companies, and governments are all locked in a nonstop race to outsmart each other.Here's a quick rundown of the latest cyber stories that show how fast the game keeps changing. Full Great Article Here

Dec 04, 2025 Ravie Lakshmanan Cybercrime / Mobile SecurityCybercriminals associated with a financially motivated group known as GoldFactory have been observed staging a fresh round of attacks targeting mobile users in Indonesia, Thailand, and Vietnam by impersonating government services.The activity, observed since October 2024, involves distributing modified banking applications that act as a conduit for Android malware, Group-IB said in a technical report published Wednesday.Assessed to be active as far back as June 2023, GoldFactory first gained attention early last year, when the Singapore-headquartered cybersecurity company detailed the threat actor's use of custom malware families like GoldPickaxe, GoldDigger, and GoldDiggerPlus targeting both Android and iOS devices.Evidence points to GoldFactory being a well-organized Chinese-speaking cybercrime group with close connections to Gigabud, another Android malware that was spotted in mid-2023. Despite major disparities in their code

December 3, 2025 By Bill Toulas In just three months, the massive Aisuru botnet launched more than 1,300 distributed denial-of-service attacks, one of them setting a new record with a peak at 29.7 terabits per second.Aisuru is a huge botnet-for-hire service that provides an army of routers and IoT devices compromised via known vulnerabilities or through brute-forcing weak credentials.Internet management and infrastructure company Cloudflare estimates that the botnet uses between one and four million infected hosts across the world.Cybercriminals can rent from distributors parts of the Aisuru botnet to launch distributed denial-of-service (DDoS) attacks.The largest hyper-volumetric attack from Aisuru-controlled devices occurred in the third quarter of 2025 and was successfully mitigated by Cloudflare.The previous record DDoS attack, which peaked at 22.2 Tbps, was also mitigated by Cloudflare and was attributed to Aisuru with medium confidence. More recently, Microsoft disclosed that the

Dec 04, 2025 The Hacker NewsWeb Security / Data PrivacyAs 2025 draws to a close, security professionals face a sobering realization: the traditional playbook for web security has become dangerously obsolete. AI-powered attacks, evolving injection techniques, and supply chain compromises affecting hundreds of thousands of websites forced a fundamental rethink of defensive strategies.Here are the five threats that reshaped web security this year, and why the lessons learned will define digital protection for years to come. Great Full Article Here

I uninstalled the offending apps and all is well now.  I just ran Webroot and from the PC Security screen it says it is infected. The offending malicious files are Hidemouse.exe and Password.exe How do I clean it?

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.CVE-2021-26828OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.  Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely r

December 3, 2025 By Pierluigi Paganini The University of Pennsylvania and the University of Phoenix confirm they were hit in the Oracle E-Business Suite hacking campaign.The University of Pennsylvania (Penn) and the University of Phoenix confirmed they were hit in the recent cyberattack targeting Oracle E-Business Suite customers.Penn explained that it uses Oracle’s E-Business Suite (EBS) platform for supplier payments, reimbursements, ledger entries, and other business operations. After Oracle announced that the flaw could enable unauthorized access, affecting hundreds of organizations worldwide, Penn launched an immediate investigation with cybersecurity experts and notified federal law enforcement.During the investigation, Penn confirmed that data from its Oracle EBS environment had been accessed without authorization. The University then conducted a detailed review to determine whether personal information was involved. On November 11, 2025, Penn concluded that the recipient’s pers

December 3, 2025 By Sergiu Gatlan Freedom Mobile, the fourth-largest wireless carrier in Canada, has disclosed a data breach after attackers hacked into its customer account management platform and stole the personal information of an undisclosed number of customers.Founded in 2008 as Wind Mobile by telecommunications provider Globalive, Freedom has over 2,2 million subscribers and now says it provides coverage to 99% of Canadians.Vidéotron, a subsidiary of Canadian telecommunications company Québecor, acquired Freedom in 2023, creating the country's fourth major wireless carrier with more than 3.5 million mobile customers and nearly 7,500 employees.In a data breach notification published today, Freedom said it detected a breach of its customer account management platform on October 23."Our investigation revealed that a third party used the account of a subcontractor to gain access to the personal information of a limited number of our customers," Freedom stated. >>Full Article&l

December 3, 2025 By Hilbert Hagedoorn ASUS may be dealing with a serious security incident after the Everest ransomware group publicly claimed it stole around 1 TB of internal company data. Everest posted directory screenshots to back up the claim, showing what looks like firmware-related folders, development materials, and other engineering files. ASUS hasn’t confirmed anything yet, so for now the situation remains a claimed breach rather than a verified one. Still, the volume and nature of the alleged files have already triggered plenty of discussion among security analysts. Everest states that this was not an encryption-based attack. Instead, the operation focused on extracting data and preparing it for sale. The group is known for exfiltration-driven intrusions where stolen files are monetized without disrupting normal business operations. This trend has grown across the ransomware landscape, as intellectual property often holds more market value than traditional ransom demands. In

Arizona is the latest state to sue Temu and its parent company PDD Holdings over allegations that the Chinese online retailer is stealing customers’ data.   December 3, 2025 By Associated Press Arizona Attorney General Kris Mayes announced Tuesday that Arizona is the latest state to sue Temu and its parent company PDD Holdings Inc. over allegations that the Chinese online retailer is stealing customers’ data.Mayes said the app deceives customers about the quality of its low-cost products and collects what she described as a shocking amount of sensitive data without the consent of users, including GPS locations and a list of other apps on users’ phones.According to the lawsuit, prosecutors are concerned about Temu being subject to laws in China that require Chinese companies to hand over data requested by the government, and that its code is designed to evade security reviews.“It can detect everywhere you go, to a doctor’s office, to a public library, to a political event, to your frien

December 2, 2025 The Federal Trade Commission is sending payments totaling nearly $15.3 million to consumers who were affected by deceptively marketed antivirus software from Avast.In February 2024, the FTC alleged that Avast used its browser extensions and antivirus software to collect, store, and sell consumers’ browsing information without adequate notice and without consumer consent. The FTC also alleged that Avast deceived users by claiming that the software would protect consumers’ privacy by blocking third party tracking, but it failed to adequately inform consumers that it would then sell their detailed, re-identifiable browsing data. As part of the June 2024 settlement with the FTC, Avast is required to provide redress to consumers and is prohibited from selling or licensing web browsing data for advertising purposes.The FTC is sending checks, PayPal, and Zelle payments to 103,152 Avast customers who filed a valid claim. Consumers selected their payment method when they comple

MuddyWater uses a fake Snake game to gain persistence December 3, 2025 By Benedict Collins  An Iranian-aligned group is targeting Israeli and Egyptian infrastructure The group's previous attacks have been noisy and easy to detect New techniques and malware have been deployedAn Iranian-aligned hacking group tracked as 'MuddyWater' has dramatically shifted tactics in attacks against Israeli and Egyptian critical infrastructure.Previous campaigns by the group, observed by ESET Research, were characteristically noisy in their tactics, techniques, and procedures (TTPs) making them easily detectable.However, the group has begun employing a new backdoor deployed via the Fooder loader, which often disguises itself as the classic Snake game. >>Full Article<<

Related topics:Cybersecurity Best Practices, Critical Infrastructure Security and Resilience, Industrial Control Systems CISA and the Australian Signals Directorate’s Australian Cyber Security Centre, in collaboration with federal and international partners, have released new cybersecurity guidance: Principles for the Secure Integration of Artificial Intelligence in Operational Technology.This guidance aims to help critical infrastructure owners and operators integrate artificial intelligence (AI) into operational technology (OT) systems securely, balancing the benefits of AI—such as increased efficiency, enhanced decision-making, and cost savings—with the unique risks it poses to the safety, security, and reliability of OT environments.The document focuses on machine learning (ML), large language models (LLMs), and AI agents due to their complex security challenges, but is also applicable to systems using traditional statistical modeling and logic-based automation.Key Principles for S

Related topics:Cybersecurity Best Practices, Critical Infrastructure Security and Resilience, Industrial Control Systems Artificial intelligence (AI) has the potential to increase efficiency and productivity, enhance decision-making, cut costs and improve customer experience, but introducing AI in operational technology (OT) environments can introduce risks that require careful management to support the safety, security, and reliability of OT systems.CISA and the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC), in collaboration with federal and international partners, co-authored this joint cybersecurity guidance for critical infrastructure owners and operators integrating AI into their OT systems. This guidance outlines four key principles owners and operators can follow to realize the benefits of integrating AI into OT systems while reducing risk. It focuses on machine learning, large language model-based AI, and AI agents because of the complex securit

December 3, 2025 By Sergiu Gatlan Microsoft has silently "mitigated" a high-severity Windows LNK vulnerability exploited by multiple state-backed and cybercrime hacking groups in zero-day attacks.Tracked as CVE-2025-9491, this security flaw allows attackers to hide malicious commands within Windows LNK files, which can be used to deploy malware and gain persistence on compromised devices. However, the attacks require user interaction to succeed, as they involve tricking potential victims into opening malicious Windows Shell Link (.lnk) files.Threat actors distribute these files in ZIP or other archives because email platforms commonly block .lnk attachments due to their risky nature.The vulnerability lies in how Windows handles .LNK files, allowing threat actors to exploit the way the operating system displays them to evade detection and execute code on vulnerable devices without the user's knowledge by padding the Target field in Windows .LNK files with whitespaces to hide malicious c