Security. In focus.

SAP Patches Critical S/4HANA Vulnerability - SecurityWeek

SAP released 15 new security notes, including four critical fixes, addressing vulnerabilities in S/4HANA, NetWeaver, and other products. Two of the critical fixes, CVE-2025-42950 and CVE-2025-42957, are code injection issues that could lead to arbitrary code execution and full system compromise. Organizations are advised to install the updates to prevent exploitation by threat actors.

Dutch Investigators Blame Multiple Threat Actors on Hacks

Dutch investigators believe multiple threat actors, possibly Russian, were involved in a May breach of the country’s law enforcement network using a Citrix NetScaler flaw. The breach, which exploited a zero-day vulnerability, also targeted critical infrastructure organizations. The Dutch National Cyber Security Centre is investigating the extent of the attacks.

Keys to the Kingdom: Erlang/OTP SSH Vulnerability Analysis and Exploits Observed in the Wild unit42.paloaltonetworks.com/erlang-ot…

This article presents our observations of exploit attempts targeting CVE-2025-32433. This vulnerability allows unauthenticated remote code execution (RCE) in the Secure Shell (SSH) daemon (sshd) from certain versions of the Erlang programming language’s Open Telecom Platform (OTP).

Erlang/OTP sshd is widely used in critical infrastructure and operational technology (OT) networks.With a CVSS score of 10.0, CVE-2025-32433 enables unauthenticated clients to execute commands by sending SSH connection protocol messages (codes >= 80) to open SSH ports, which should only be processed after successful authentication. Vulnerable versions include Erlang/OTP prior to OTP-27.3.3, OTP-26.2.5.11 and OTP-25.3.2.20.

A patch is available in Erlang/OTP versions OTP-27.3.3, OTP-26.2.5.11, OTP-25.3.2.20 and later.

From ClickFixto Command: A Full PowerShell Attack Chain www.fortinet.com/blog/thre…

The FortiMail Workspace Security team recently identified a targeted intrusion campaign impacting multiple Israeli organizations. The adversary leveraged compromised internal email infrastructure to distribute phishing messages across the regional business landscape. These emails initiated a multi-stage, PowerShell-based infection chain that culminated in the delivery of a remote access trojan (RAT), executed entirely through PowerShell.

The following report outlines technical observations from the campaign, including delivery tactics, obfuscation methods, C2 activity, and MITRE ATT&CK mappings.

MuddyWater’s DarkBit ransomware cracked for free data recovery www.bleepingcomputer.com/news/secu…

Cybersecurity firm Profero cracked the encryption of the DarkBit ransomware gang’s encryptors, allowing them to recover a victim’s files for free without paying a ransom.

This occurred in 2023 during an incident response handled by Profero experts, who were brought in to investigate a ransomware attack on one of their clients, which had encrypted multiple VMware ESXi servers.

The timing of the cyberattack suggests that it was in retaliation for the 2023 drone strikes in Iran that targeted an ammunition factory belonging to the Iranian Defence Ministry.

Over 29,000 Exchange servers unpatched against high-severity flaw www.bleepingcomputer.com/news/secu…

Over 29,000 Exchange servers exposed online remain unpatched against a high-severity vulnerability that can let attackers move laterally in Microsoft cloud environments, potentially leading to complete domain compromise.

The security flaw (tracked as CVE-2025-53786) helps threat actors who gain administrative access to on-premises Exchange servers to escalate privileges within the organization’s connected cloud environment by forging or manipulating trusted tokens or API calls, without leaving easily detectable traces and making it hard to detect exploitation.

CVE-2025-53786 affects Exchange Server 2016, Exchange Server 2019, and Microsoft Exchange Server Subscription Edition, which replaces the perpetual license model with a subscription-based one, in hybrid configurations.

Update WinRAR tools now: RomCom and others exploiting zero-day vulnerability www.welivesecurity.com/en/eset-r…

ESET researchers have discovered a previously unknown vulnerability in WinRAR, being exploited in the wild by Russia-aligned group RomCom. This is at least the third time that RomCom has been caught exploiting a significant zero-day vulnerability in the wild. Previous examples include the abuse of CVE-2023-36884 via Microsoft Word in June 2023, and the combined vulnerabilities assigned CVE‑2024‑9680 chained with another previously unknown vulnerability in Windows, CVE‑2024‑49039, targeting vulnerable versions of Firefox, Thunderbird, and the Tor Browser, leading to arbitrary code execution in the context of the logged-in user in October 2024.

The vulnerability allows hiding malicious files in an archive, which are silently deployed when extracting. Successful exploitation attempts delivered various backdoors used by the RomCom group, specifically a SnipBot variant, RustyClaw, and Mythic agent.

Ransomware Diaries Volume 7: “I Had to Take the Guilt For Everyone” – The Kaseya Hacker Breaks His Silence analyst1.com/ransomwar…

Yaroslav Vasinskyi is the former REvil affiliate known as ‘Rabotnik’ who executed the devastating Kaseya supply chain attack that compromised over 1,500 companies. Just weeks prior to Kaseya, the impact of previous REvil ransomware attacks triggered a direct in-person meeting between then United States President Joe Biden and Russian President Vladimir Putin. At that meeting, Biden warned: “If it is either with the knowledge of and/or a consequence of Russia, then I told Putin we will respond.”

It wasn’t just another ransomware incident. It was the largest ransomware supply chain breach in history. The damage from the attack impacted 17 countries and forced schools, pharmacies, and entire supermarket chains offline. “The world’s largest to date,” Europol called it. In Sweden, 800 Coop grocery stores closed their doors. In New Zealand, entire school networks were taken offline.

UWA hit by major data breach, students locked out of accounts | news.com.au — Australia’s leading news site for latest headlines

A data breach at the University of Western Australia compromised hundreds of passwords, leading to account lockouts for staff and students. The university is investigating the incident and has implemented countermeasures, including a password reset for all users.

60 malicious Ruby gems downloaded 275,000 times steal credentials www.bleepingcomputer.com/news/secu…

Sixty malicious Ruby gems containing credential-stealing code have been downloaded over 275,000 times since March 2023, targeting developer accounts.

The malicious Ruby gems were discovered by Socket, which reports they targeted primarily South Korean users of automation tools for Instagram, TikTok, Twitter/X, Telegram, Naver, WordPress, and Kakao.

RubyGems is the official package manager for the Ruby programming language, enabling the distribution, installation, and management of Ruby libraries, known as gems, much like npm for JavaScript or PyPI for Python. The malicious gems in this campaign were published onto RubyGems.org under various aliases over the years.

Google Calendar invites let researchers hijack Gemini to leak user data www.bleepingcomputer.com/news/secu…

Google fixed a bug that allowed maliciously crafted Google Calendar invites to remotely take over Gemini agents running on the target’s device and leak sensitive user data.

The attack unfolded without requiring any user involvement beyond typical interactions with the assistant, which occur daily for users of Gemini.

Gemini is Google’s large language model (LLM) assistant integrated into Android, Google web services, and Google’s Workspace apps, having access to Gmail, Calendar, and Google Home.

By sending a calendar invite with an embedded prompt injection, often hidden in the event title, attackers can potentially exfiltrate email content and Calendar information, track victim location, control smart home devices via Google Home, open apps on Android, and trigger Zoom video calls.

DEF CON hackers plug security holes in US water systems amid tsunami of threats www.theregister.com/2025/08/1…

A DEF CON hacker walks into a small-town water facility…no, this is not the setup for a joke or a (super-geeky) odd-couple rom-com. It’s a true story that happened at five utilities across four states.

And now, nine months into providing free cybersecurity services to a handful of American critical infrastructure systems, the project’s organizers plan to grow the initiative massively before the end of the year to protect thousands of water systems across the country.

The Franklin project, named for Benjamin Franklin, who founded America’s first volunteer fire department, launched at last year’s DEF CON with 350 people signing up to give their time and talent to water facilities at no charge.

The volunteers were deployed across five water systems in four states — Indiana, Oregon, Utah, and Vermont — and provided no-cost assistance with cybersecurity basics, such as making sure the utilities had changed default passwords and turned on multi-factor authentication. They also assisted with asset inventories, operational technology (OT) assessments, and network mapping and scanning.

BadCam: Linux-based Lenovo webcam bugs enable BadUSB attacks

Eclypsium researchers discovered vulnerabilities in Lenovo webcams, dubbed BadCam, that allow attackers to remotely hijack and weaponize them as BadUSB devices. The flaws enable attackers to inject keystrokes, launch OS-independent attacks, and persistently re-infect hosts. Lenovo has released an updated installation tool with signature validation to address the issue.

AgentFlayer 0-click exploit abuses ChatGPT Connectors to Steal 3rd-party app data

Cybersecurity researchers at Zenity have discovered “AgentFlayer,” a critical zero-click vulnerability in ChatGPT Connectors that allows attackers to secretly steal sensitive data from users’ connected accounts like Google Drive and SharePoint. The attack uses indirect prompt injection by embedding hidden malicious instructions in innocent-looking documents using invisible text, which execute when users ask ChatGPT to process the document. When the hidden commands activate, they instruct ChatGPT to search for sensitive information like API keys in the user’s connected accounts, then exfiltrate the data through specially crafted image URLs that send stolen information to attacker-controlled servers without the user’s knowledge or clicks. Zenity presented this vulnerability at Black Hat conference, demonstrating how attackers can bypass OpenAI’s existing security measures and exploit the trust relationship between ChatGPT and third-party applications. This attack represents part of a larger class of AI agent vulnerabilities, with researchers warning that similar flaws are likely to emerge in other popular AI products due to poor understanding of dependencies and insufficient guardrails in AI-to-third-party integrations.​​​​​​​​​​​​​​​​

New Win-DDoS Flaws Let Attackers Turn Public Domain Controllers into DDoS Botnet via RPC, LDAP

A new attack technique, Win-DDoS, exploits vulnerabilities in Windows LDAP client code to turn public domain controllers into a DDoS botnet. The attack, which doesn’t require code execution or credentials, can overwhelm victim servers and potentially crash domain controllers. Microsoft has patched four related vulnerabilities in Windows LDAP, LSASS, Netlogon, and Print Spooler Components.

UK proxy traffic surges as users consider VPN alternatives amid Online Safety Act www.theregister.com/2025/08/0…

Amid the furor around surging VPN usage in the UK, many users are eyeing proxies as a potential alternative to the technology.

A proxy server sits between a device and the internet – the most common type is a “forward proxy” – effectively acting as an intermediary and masking a user’s IP address. It can also overcome geo-restrictions and, in light of recent restrictions in the UK arising from the Online Safety Act, present an alternative to VPNs.

The UK’s Online Safety Act requires regulated services providing primary-priority content, such as commercial pornography or self-harm and suicide material, to check the age of UK users before allowing access.

North Korean cyber-espionage group ScarCruft adds ransomware in recent attack therecord.media/scarcruft…

The North Korean state-backed hacker group tracked as ScarCruft recently took the unusual step of infecting targets with ransomware alongside other malicious files, researchers said.

ScarCruft, primarily known for cyber-espionage campaigns against high-profile individuals and government entities, used “newly observed” ransomware as part of the operation, analysts at South Korean cybersecurity firm S2W said in a report on Thursday.

The researchers labeled the ransomware VCD after the extension it appends to the names of encrypted files. It drops two versions of its ransom note, one in English and the other in Korean, the researchers said.

ScarCruft’s use of ransomware “suggests a potential shift toward financially motivated operations, or an expansion of operational goals that now include disruptive or extortion-driven tactics,” S2W said.

EU law to protect journalists from spyware takes effect therecord.media/eu-law-to…

A landmark law meant to protect journalists in the European Union from spyware and other forms of surveillance came into effect Friday, but critics at press freedoms groups say the measure could ultimately prove toothless.

EU countries have done little to “align domestic legislation with the rules outlined by the EMFA (the European Media Freedoms Act), despite having had more than one year to do so,” a coalition of press freedom groups said in a joint statement, referring to EMFA’s adoption in March 2024.

“Regrettably, we are deeply concerned that many national governments are neither prepared nor politically willing to make the required legislative changes,” the statement said. “This lack of commitment poses a serious risk to the EMFA’s effectiveness.”

Even if member states were ready to enforce EMFA, critics have long warned that changes made after it was first proposed to much fanfare in 2022 have considerably weakened its surveillance protections.

Scammers mass-mailing the Efimer Trojan to steal crypto securelist.com/efimer-tr…

In June, Kaspersky encountered a mass mailing campaign impersonating lawyers from a major company. These emails falsely claimed the recipient’s domain name infringed on the sender’s rights. The messages contained the Efimer malicious script, designed to steal cryptocurrency. This malware was dubbed “Efimer” because the word appeared in a comment at the beginning of its decrypted script. Early versions of this Trojan likely emerged around October 2024, initially spreading via compromised WordPress websites.

The emails that users received claimed that lawyers from a large company had reviewed the recipient’s domain and found words or phrases in its name that infringed upon their registered trademarks. The emails threatened legal action but offered to drop the lawsuit if the domain owner changed the domain name. Furthermore, they even expressed willingness to purchase the domain. The specific domain was never mentioned in the email. Instead, the attachment supposedly contained “details” about the alleged infringement and the proposed buyout amount.

U.S. Judiciary confirms breach of court electronic records service www.bleepingcomputer.com/news/secu…

The U.S. Federal Judiciary confirms that it suffered a cyberattack on its electronic case management systems hosting confidential court documents and is strengthening cybersecurity measures.

The organization stated that, while most documents in the system are public, certain sealed filings contain sensitive information that is now protected with stricter access controls aimed at blocking hackers.

“The federal Judiciary is taking additional steps to strengthen protections for sensitive case documents in response to recent escalated cyberattacks of a sophisticated and persistent nature on its case management system,” reads the announcement.

US confirms takedown of BlackSuit ransomware gang that racked up $370 million in ransoms therecord.media/us-confir…

U.S. law enforcement agencies provided new details on an operation that dismantled critical infrastructure used by the BlackSuit ransomware gang after the organization’s leak site was replaced with a takedown banner nearly two weeks ago.

The group — which rebranded from its Royal name after a devastating 2023 attack that shut down the city of Dallas — successfully attacked more than 450 entities in the U.S. Since emerging in 2022, the gang secured more than $370 million in ransom payments, according to U.S. investigators.

“The BlackSuit ransomware gang’s persistent targeting of U.S. critical infrastructure represents a serious threat to U.S. public safety,” said Assistant Attorney General for National Security John Eisenberg.

Two weeks ago, the ransomware gang’s darknet extortion sites were seized in an operation involving police from more than nine countries including Germany, France and the United Kingdom.

Cartels may be able to target witnesses after major court hack www.politico.com/news/2025…

Officials fear that Latin American drug cartels are among those who obtained sensitive court data due to a sweeping breach of the federal judiciary’s case filing system, raising concerns that the groups will now be able to target cooperating witnesses involved in criminal trials against them.

The worry, according to three judicial officials and investigators with knowledge of the hack, is that cartels could weaponize the stolen data to identify witnesses in cases the federal government has opened against them, or to gain knowledge of impending or ongoing criminal investigations, such as sealed wiretap orders and arrest and search warrants.

POLITICO first reported on the hack, which the Administrative Office of the U.S. Courts determined was serious, in early July. At least a dozen district courts across several U.S. states are believed to have been directly impacted by the ongoing compromise of the digital case filing system, known as CM/ECF, according to the first two people. The incident is believed to be one of the most serious hacks into the federal court filing system in years.

Embargo ransomware gang has handled at least $34 million in about a year, report says therecord.media/embargo-r…

A cybercrime group that could be a successor to the BlackCat/Alphv ransomware operation is associated with about $34.2 million in cryptocurrency transactions since popping up in mid-2024, researchers said Friday.

Blockchain intelligence company TRM Labs said the Embargo ransomware gang appears to be “well resourced and technically capable,” and its activity over such a short span underscores “the group’s growing financial footprint in the ransomware ecosystem.”

Embargo started to draw scrutiny in late 2024, just a few months after BlackCat’s leaders appeared to conduct an exit scam on affiliates. Echoing other companies, TRM said the gang “may be a rebranded or successor operation to BlackCat (ALPHV) based on multiple technical and behavioral similarities,” including the infrastructure of its crypto wallets.

Like BlackCat, Embargo is a ransomware-as-a-service operation, providing affiliates with the tools they need to conduct attacks while taking a cut of any proceeds.

Courts service ‘covered up’ IT bug that caused evidence to go missing www.bbc.com/news/arti…

The body running courts in England and Wales has been accused of a cover-up, after a leaked report found it took several years to react to an IT bug that caused evidence to go missing, be overwritten or appear lost.

Sources within HM Courts & Tribunals Service (HMCTS) say that as a result, judges in civil, family and tribunal courts will have made rulings on cases when evidence was incomplete.

The internal report, leaked to the BBC, said HMCTS did not know the full extent of the data corruption, including whether or how it had impacted cases, as it had not undertaken a comprehensive investigation. It also found judges and lawyers had not been informed, as HMCTS management decided it would be “more likely to cause more harm than good”.

Encryption made for police and military radios may be easily cracked arstechnica.com/security/…

Two years ago, researchers in the Netherlands discovered an intentional backdoor in an encryption algorithm baked into radios used by critical infrastructure–as well as police, intelligence agencies, and military forces around the world–that made any communication secured with the algorithm vulnerable to eavesdropping.

When the researchers publicly disclosed the issue in 2023, the European Telecommunications Standards Institute (ETSI), which developed the algorithm, advised anyone using it for sensitive communication to deploy an end-to-end encryption solution on top of the flawed algorithm to bolster the security of their communications.

But now the same researchers have found that at least one implementation of the end-to-end encryption solution endorsed by ETSI has a similar issue that makes it equally vulnerable to eavesdropping. The encryption algorithm used for the device they examined starts with a 128-bit key, but this gets compressed to 56 bits before it encrypts traffic, making it easier to crack.