cybersecurity

cross-posted from: https://lemmy.sdf.org/post/34536054

Archived

China-Nexus Nation State Actors Exploit SAP NetWeaver (CVE-2025-31324) to Target Critical Infrastructures, according to a research.

In April 2025, China-nexus nation-state APTs (advanced persistent threat) launched high-temp exploitation campaigns against critical infrastructure networks by targeting SAP NetWeaver Visual Composer. Actors leveraged CVE-2025-31324 [...], an unauthenticated file upload vulnerability that enables remote code execution (RCE). This assessment is based on a publicly exposed directory (opendir) found on attacker-controlled infrastructure, which contained detailed event logs capturing operations across multiple compromised systems.

[...]

EclecticIQ analysts link observed SAP NetWeaver intrusions to Chinese cyber-espionage units including UNC5221 [...], UNC5174 [...], and CL-STA-0048 [...] based on threat actor tradecrafts patterns. Mandiant and Palo Alto researchers assess that these groups connect to China's Ministry of State Security (MSS) or affiliated private entities. These actors operate strategically to compromise critical infrastructures, exfiltrate sensitive data, and maintain persistent access across high-value networks worldwide.

[...]

Targets of the campaign were

• natural gas distribution networks, water and integrated waste management utilities in the United Kingdom,

• medical device manufacturing plants oil and gas exploration and production companies in the United States, and

• government ministries in Saudi Arabia that are responsible for investment strategy and financial regulation.

[...]

• The new class of vulnerabilities in Intel processors arises from speculative technologies that anticipate individual computing steps.
• Openings enable gradual reading of entire privilege memory contents of shared processor (CPU).
• All Intel processors from the last 6 years are affected, from PCs to servers in data centres.

cross-posted from: https://lemmy.sdf.org/post/34478394

Archived

Britain’s intelligence services are seeing a “direct connection between Russian cyber attacks and physical threats to our security,” the country’s cyber chief announced on Wednesday.

Malign actors in Moscow are “waging acts of sabotage, often using criminal proxies in their plots,” warned Richard Horne, the head of the National Cyber Security Centre (NCSC) at the CYBERUK conference in Manchester.

Horne said both NCSC and the domestic security service MI5 were seeing the hacking threat from Russia manifesting “on the streets of the U.K. against our industries and our businesses, putting lives, critical services and national security at risk.”

He told the CYBERUK audience that the role of the information security community was “therefore not just about protecting systems, it’s about protecting our people, our economy, our society, from harm.”

[...]

[Among others], Russia is believed to have been behind a July 2024 blaze that also affected the DHL logistics chain in Leipzig, Germany. If that parcel bomb bound for the U.K. had detonated aboard a flight it could have caused a plane crash, German security services said.

A third incident took place in July near Warsaw, the capital of Poland. As reported by Reuters, the attempts are believed to be a “dry run” for a future plot in which Russia detonates incendiary devices in midair on transatlantic cargo flights to the United States and Canada.

The devices were reportedly disguised as massage machines from Lithuania and **contained a magnesium-based substance which could have burned so destructively that an aircraft would have crashed. ** In November, Kęstutis Budrys, the chief national security adviser to Lithuania’s President Gitanas Nausėda, blamed Russia’s military intelligence agency, known as the GRU, for the plots. Other Western security officials have agreed with this assessment.

[...]

Weekly thread for any and all career, learning and general guidance questions. Thinking of taking a training or going for a cert? Wondering how to level up your career? Wondering what NOT to do? Got other questions? This is the time and place to ask!

Wanna chat about something non-infosec amongst those of us who frequent /c/cybersecurity? Here’s your chance! (Keep things civil & respectful please)

cross-posted from: https://scribe.disroot.org/post/2697498

cross-posted from: https://scribe.disroot.org/post/2697495

Archived link

Foreign powers, ransomware gangs and AI threats are driving a surge in incidents affecting British businesses and government systems, [the British Intelligence Agency] GCHQ has warned.

Britain has suffered double the number of “nationally significant” cyberattacks in recent months compared with the year before, according to GCHQ.

Richard Horne, chief executive of the National Cyber Security Centre (NCSC), said that the GCHQ unit has managed 200 cyberattacks since September, which includes “twice as many nationally significant incidents as the same period last year”.

...

Referencing the recent attacks on Marks & Spencer, Co-op and Harrods, Horne told the CyberUK conference in Manchester that “the threat picture is diverse and dramatic” and called ransomware “a persistent threat”.

...

Rod Latham, director of cybersecurity at the Department for Science, Innovation and Technology, said: “Our statistics indicate that four in ten businesses are attacked in a year, three in ten charities — millions of cybercrimes in a year.”

...

Horne called China “the pacing threat in the cyber-realm” and “a cause for profound and profuse concern”.

...

On Russia he said that “we see a direct connection between Russian cyberattacks and physical threats to our security” and warned that amid talks on Ukraine, “it is almost certain that Russia will continue its wider cyber espionage activity … against Ukraine and supporting countries”.

...

Today we released Vulnerability-Lookup 2.9.0 with new features, enhancements, and bug fixes.

What's New

Adversarial Techniques from MITRE EMB3D

The Adversarial Techniques from MITRE EMB3D are now integrated into Vulnerability-Lookup as a new source and are correlated with existing security advisories.

This feature was contributed by Piotr Kaminski during the last Hack.lu hackathon. (#129)

Global CVE Allocation System (GCVE)

GCVE identifiers are now supported in HTML templates and URL parameters,
thanks to the GCVE Python client.
These identifiers can now be used when disclosing a new vulnerability as part of the Coordinated Vulnerability Disclosure (CVD) process, in alignment with NIS 2 requirements. (8bb3d84, 58c394a)

Trustworthy Level for Members

Members of a Vulnerability-Lookup instance now have a dynamically calculated
trustworthy level based on profile completeness and verification.
Members affiliated with FIRST.org or European CSIRTs (CNW) are automatically
trusted for operations that would otherwise require administrator approval
(e.g., creating comments).

Changes

• New API endpoint for MITRE EMB3D. (c0d6b44)
• Improved the vulnerability disclosure page. (ccfb6b1)
• Added page arguments to the vulnerability/last endpoint. (ce75a7a)
• Notification emails now include a random signoff. (#119)
• Various graphical enhancements. (0878a31)

Fixes

• Fixed editing of notifications for Organization/Product. (#124)

Changelog

📂 To see the full rundown of the changes, users can visit the changelog on GitHub: https://github.com/vulnerability-lookup/vulnerability-lookup/releases/tag/v2.9.0

Weekly thread to discuss whatever you’re working on, big or small, at work or in your free time.

Check Point Research uncovered a sophisticated phishing campaign that abuses Discord and targets crypto users. Attackers redirects users from a legitimate Web3 website to a fake Collab.Land bot and then to a phishing site, tricking them into signing malicious transactions. The drainer script deployed on that site was directly linked to Inferno Drainer. Despite publicly shutting down in late 2023, Inferno Drainer remained fully operational. Smart contracts deployed in 2023 continued to be used into 2025. Recent campaigns show notable technical upgrades and infrastructure improvements. Inferno Drainer employs advanced anti-detection tactics — including single-use and short-lived smart contracts, on-chain encrypted configurations, and proxy-based communication — successfully bypassing wallet security mechanisms and anti-phishing blacklists. In just the last six months, more than 30,000 wallets were victimized by Inferno Drainer, resulting in at least $9 million in losses. The combination of evolving technical sophistication and convincing social engineering continues to drive the success of these attacks.

cross-posted from: https://lemmy.sdf.org/post/33999334

Archived

• Under the new rules, tenders will award bonus scores to offers that deploy cybersecurity technologies manufactured in Italy, EU member states, NATO countries, or other like-minded partners.
• The legislation follows high‑profile incidents of Chinese technology infiltrating sensitive sites, ranging from surveillance cameras in courts and ministries to thermoscanners at the prime minister’s office, and the award of customs‑scanner contracts to China’s Nuctech.
• Products include: video surveillance and access‑control systems (including baggage and cargo scanners); VPN‑capable digital networking products, routers, modems (including satellite types), and switches; firewalls, intrusion detection and prevention systems; network storage and backup solutions; cloud services; drone‑control software
• Preference is extended to suppliers from the EU, NATO members, and “like‑minded” countries with collaboration agreements—namely Australia, South Korea, Japan, Israel, New Zealand, and Switzerland.
• The government retains authority to update the list of covered categories and beneficiary states, based on recommendations from public administrations and intelligence agencies, ensuring the framework evolves alongside emerging security needs.

[...]

Blogged a bit about Kidflix login credentials and tried to make some basic password analysis. Originally the bulk of the post was written in the beginning of April, but I forgot and it was just sitting there in my drafts directory.

cross-posted from: https://scribe.disroot.org/post/2673818

[This is an op-ed by Tin Pak, visiting academic at the National Defense University and a researcher at the Institute for National Defense and Security Research in Taiwan, and Chen Yu-cheng, an associate professor at the National Defense University.

The term “assassin’s mace” originates from Chinese folklore, describing a concealed weapon used by a weaker hero to defeat a stronger adversary with an unexpected strike. In more general military parlance, the concept refers to an asymmetric capability that targets a critical vulnerability of an adversary. China has found its modern equivalent of the assassin’s mace with its high-altitude electromagnetic pulse (HEMP) weapons, which are nuclear warheads detonated at a high altitude, emitting intense electromagnetic radiation capable of disabling and destroying electronics.

An assassin’s mace weapon possesses two essential characteristics: strategic surprise and the ability to neutralize a core dependency. HEMP weapons fit both criteria. In nanoseconds, a single HEMP detonation at an altitude between 20km and 50km can disable electronic infrastructure across large swathes of Taiwan. There would be little warning, as the Chinese People’s Liberation Army (PLA) fields DF-17 hypersonic missiles, capable of delivering a HEMP warhead above Taiwan in a matter of minutes.

HEMPs strike at the foundation of modern society, its electronic systems. Every critical infrastructure uses electronics, from telecommunications, hospitals, energy production and distribution facilities, and even water purification systems.

...