Threat Intel

Reflected XSS In Main Search, WAF+Sanitizer Bypass Using 2 Reflections | by Renwa | Feb, 2025 | Medium

A reflected XSS vulnerability was discovered in the main site search, bypassing a WAF and HTML sanitizer using two reflections of the input. The exploit involves injecting an with an onload event and manipulating the window.name attribute to execute JavaScript code.</p> </div> <div class="ti-meta"><a class="u-url" href="https://threatintel.cc/2025/02/12/reflected-xss-in-main-search.html">View curation<span aria-hidden="true"> ›</span><span class="sr-only"> (permalink): Reflected XSS In Main Search, WAF+Sanitizer Bypass Using 2 Reflections | by Renwa | Feb, 2025 | …</span></a></div> </div></article></li> <li class="ti-item"><article class="h-entry"> <div class="ti-item-context"> <p class="ti-source-label"><span class="ti-context-label">Source</span><span>www.darkreading.com</span></p> <p class="ti-curation-date"><span class="ti-context-label">Curated</span><time class="dt-published" datetime="2025-02-12T22:51:11-04:00">Feb 12, 2025</time></p> </div> <div class="ti-item-content"> <div class="post-body e-content"><h2 class="ti-source-headline p-name"><a href="https://www.darkreading.com/cybersecurity-operations/japan-offense-new-cyber-defense-bill">Japan Goes on Offense With New ‘Active Cyber Defense’ Bill</a></h2> <p>Japan has passed the Active Cyber Defense Bill, granting the government new powers to combat cyberattacks. The legislation, a response to mounting cyber threats and criticism of Japan’s cybersecurity preparedness, enables proactive measures like shutting down enemy servers and hiring “cyber harm prevention officers.” While controversial, the bill reflects Japan’s shift towards a more proactive cybersecurity stance.</p> </div> <div class="ti-meta"><a class="u-url" href="https://threatintel.cc/2025/02/12/japan-goes-on-offense-with.html">View curation<span aria-hidden="true"> ›</span><span class="sr-only"> (permalink): Japan Goes on Offense With New &lsquo;Active Cyber Defense&rsquo; Bill Japan has passed the Active …</span></a></div> </div></article></li> <li class="ti-item"><article class="h-entry"> <div class="ti-item-context"> <p class="ti-curation-date"><span class="ti-context-label">Published</span><time class="dt-published" datetime="2025-02-12T09:11:40-04:00">Feb 12, 2025</time></p> </div> <div class="ti-item-content"> <div class="post-body e-content"><p>Ransomware Groups Made Less Money in 2024 <a href="https://www.darkreading.com/cybersecurity-operations/ransomware-groups-made-less-money-in-2024">www.darkreading.com/cybersecu…</a></p> <p>The total volume of ransom payments decreased year-over-year by approximately 35%, due to law enforcement activities and more victims refusing to pay, according to blockchain analytics company Chainalysis.</p> <p>In 2024, ransomware attackers collected approximately $813.55 million in payments, a significant drop from the $1.25 billion collected in 2023 and $1.07 billion collected in 2021, Chainalysis said in its 2025 Crypto Crime Report.</p> <p>Improved cyber hygiene and overall resiliency is helping organizations make the decision to not pay, according to Christian Geyer, founder and CEO of Actfore. Better incident response capabilities, digital forensics, and data mining services are helping victims identify the breached data faster.</p> <p>“Organizations have increasingly implemented comprehensive data backup solutions, so the business can rapidly recover their systems through a wipe and restore process,” Geyer said.</p> </div> <div class="ti-meta"><a class="u-url" href="https://threatintel.cc/2025/02/12/ransomware-groups-made-less-money.html">View post<span aria-hidden="true"> ›</span><span class="sr-only"> (permalink): Ransomware Groups Made Less Money in 2024 www.darkreading.com/cybersecu&hellip; The total volume of …</span></a></div> </div></article></li> <li class="ti-item"><article class="h-entry"> <div class="ti-item-context"> <p class="ti-curation-date"><span class="ti-context-label">Published</span><time class="dt-published" datetime="2025-02-12T09:11:19-04:00">Feb 12, 2025</time></p> </div> <div class="ti-item-content"> <div class="post-body e-content"><p>Russian military hackers deploy malicious Windows activators in Ukraine <a href="https://www.bleepingcomputer.com/news/security/russian-military-hackers-deploy-malicious-windows-activators-in-ukraine/">www.bleepingcomputer.com/news/secu…</a></p> <p>The Sandworm Russian military cyber-espionage group is targeting Windows users in Ukraine with trojanized Microsoft Key Management Service (KMS) activators and fake Windows updates.</p> <p>These attacks likely started in late 2023 and have now been linked by EclecticIQ threat analysts with Sandworm hackers based on overlapping infrastructure, consistent Tactics, Techniques and Procedures (TTPs), and frequently used ProtonMail accounts to register domains used in the attacks.</p> <p>The attackers also used a BACKORDER loader to deploy DarkCrystal RAT (DcRAT) malware (used in previous Sandworm attacks) and debug symbols referencing a Russian-language build environment, further reinforcing the researchers' confidence that Russian military hackers were involved.</p> </div> <div class="ti-meta"><a class="u-url" href="https://threatintel.cc/2025/02/12/russian-military-hackers-deploy-malicious.html">View post<span aria-hidden="true"> ›</span><span class="sr-only"> (permalink): Russian military hackers deploy malicious Windows activators in Ukraine …</span></a></div> </div></article></li> <li class="ti-item"><article class="h-entry"> <div class="ti-item-context"> <p class="ti-curation-date"><span class="ti-context-label">Published</span><time class="dt-published" datetime="2025-02-12T09:11:04-04:00">Feb 12, 2025</time></p> </div> <div class="ti-item-content"> <div class="post-body e-content"><p>Russian bulletproof hosting service Zservers sanctioned by US for LockBit coordination <a href="https://therecord.media/zservers-russia-bulletproof-hosting-us-uk-sanctions">therecord.media/zservers-…</a></p> <p>A Russian service used to facilitate ransomware attacks by LockBit hackers has been sanctioned by U.S. authorities.</p> <p>The company, Zservers, offers bulletproof hosting — which allows cybercriminals to avoid law enforcement while renting IP addresses, servers and domains used for disseminating malware, forming botnet armies and carrying out other tasks related to fraud and cyberattacks.</p> <p>On Tuesday, the U.S. Treasury Department partnered with officials in Australia and the U.K. in sanctioning Zservers as well as Russian nationals Alexander Igorevich Mishin and Aleksandr Sergeyevich Bolshakov, who served as administrators at the company.</p> <p>According to the U.S., LockBit affiliates frequently leased IP addresses from Zservers. The company is based in Barnaul, Russia, and advertises its services on cybercriminal forums. Blockchain analysis company Elliptic said it confirmed the link between the cybercrime gang and Zservers.</p> </div> <div class="ti-meta"><a class="u-url" href="https://threatintel.cc/2025/02/12/russian-bulletproof-hosting-service-zservers.html">View post<span aria-hidden="true"> ›</span><span class="sr-only"> (permalink): Russian bulletproof hosting service Zservers sanctioned by US for LockBit coordination …</span></a></div> </div></article></li> <li class="ti-item"><article class="h-entry"> <div class="ti-item-context"> <p class="ti-curation-date"><span class="ti-context-label">Published</span><time class="dt-published" datetime="2025-02-12T09:10:34-04:00">Feb 12, 2025</time></p> </div> <div class="ti-item-content"> <div class="post-body e-content"><p>Over 12,000 KerioControl firewalls exposed to exploited RCE flaw <a href="https://www.scworld.com/brief/thousands-of-gfi-keriocontrol-firewalls-still-at-risk-of-exploited-critical-rce">www.scworld.com/brief/tho…</a></p> <p>Over twelve thousand GFI KerioControl firewall instances are exposed to a critical remote code execution vulnerability tracked as CVE-2024-52875.</p> <p>KerioControl is a network security suite that small and medium-sized businesses use for VPNs, bandwidth management, reporting and monitoring, traffic filtering, AV protection, and intrusion prevention.</p> <p>The flaw in question was discovered in mid-December by security researcher Egidio Romano (EgiX), who demonstrated the potential for dangerous 1-click RCE attacks.</p> <p>GFI Software released a security update for the problem with version 9.4.5 Patch 1 on December 19, 2024, yet three weeks later, according to Censys, over 23,800 instances remained vulnerable.</p> <p>Despite the warning about active exploitation, threat monitoring service The Shadowserver Foundation now reports seeing 12,229 KerioControl firewalls exposed to attacks leveraging CVE-2024-52875.</p> <p>“NOTE: the Reflected XSS vector might be abused to perform 1-click Remote Code Execution (RCE) attacks.”</p> <p>If you haven’t applied the security update yet, it is strongly advised that you install KerioControl version 9.4.5 Patch 2, released on January 31, 2025, which contains additional security enhancements.</p> </div> <div class="ti-meta"><a class="u-url" href="https://threatintel.cc/2025/02/12/over-keriocontrol-firewalls-exposed-to.html">View post<span aria-hidden="true"> ›</span><span class="sr-only"> (permalink): Over 12,000 KerioControl firewalls exposed to exploited RCE flaw www.scworld.com/brief/tho&hellip; …</span></a></div> </div></article></li> <li class="ti-item"><article class="h-entry"> <div class="ti-item-context"> <p class="ti-curation-date"><span class="ti-context-label">Published</span><time class="dt-published" datetime="2025-02-12T09:10:07-04:00">Feb 12, 2025</time></p> </div> <div class="ti-item-content"> <div class="post-body e-content"><p>Microsoft’s February Patch a Lighter Lift Than January’s <a href="https://www.darkreading.com/application-security/microsofts-february-patch-lighter-lift-januarys">www.darkreading.com/applicati…</a></p> <p>Microsoft’s February security update contains substantially fewer vulnerabilities for admins to address compared to a month ago, but there’s still plenty in it that requires immediate attention.</p> <p>Topping the list are two zero-day vulnerabilities that attackers are actively exploiting in the wild, two more that are publicly known but not exploited yet, a patch for a zero-day that Microsoft disclosed in December 2024, and an assortment of other common vulnerabilities and exposures (CVEs) with potentially severe consequences for affected organizations.</p> </div> <div class="ti-meta"><a class="u-url" href="https://threatintel.cc/2025/02/12/microsofts-february-patch-a-lighter.html">View post<span aria-hidden="true"> ›</span><span class="sr-only"> (permalink): Microsoft&rsquo;s February Patch a Lighter Lift Than January&rsquo;s …</span></a></div> </div></article></li> <li class="ti-item"><article class="h-entry"> <div class="ti-item-context"> <p class="ti-curation-date"><span class="ti-context-label">Published</span><time class="dt-published" datetime="2025-02-12T09:09:55-04:00">Feb 12, 2025</time></p> </div> <div class="ti-item-content"> <div class="post-body e-content"><p>SonicWall firewall exploit lets hackers hijack VPN sessions, patch now <a href="https://www.bleepingcomputer.com/news/security/sonicwall-firewall-exploit-lets-hackers-hijack-vpn-sessions-patch-now/">www.bleepingcomputer.com/news/secu…</a></p> <p>Security researchers at Bishop Fox have published complete exploitation details for the CVE-2024-53704 vulnerability that allows bypassing the authentication mechanism in certain versions of the SonicOS SSLVPN application.</p> <p>The vendor warned about the high exploitation possibility of the flaw in a bulletin on January 7, urging administrators to upgrade their SonicOS firewalls' firmware to address the problem.</p> <p>The flaw allows a remote attacker to hijack active SSL VPN sessions without authentication, granting them unauthorized access to the victim’s network.</p> <p>On January 22 Bishop Fox researchers announced that they had developed an exploit for CVE-2024-53704 after a “significant reverse-engineering effort,” confirming SonicWall’s fears about the exploitation potential of the vulnerability.</p> <p>After allowing some time for system administrators to apply the available patches, Bishop Fox released the full exploitation details on Monday.</p> <p>Fixes were made available in SonicOS 8.0.0-8037 and later, 7.0.1-5165 and higher, 7.1.3-7015 and higher, and 6.5.5.1-6n and higher. For model-specific information, check out SonicWall’s bulletin here.</p> </div> <div class="ti-meta"><a class="u-url" href="https://threatintel.cc/2025/02/12/sonicwall-firewall-exploit-lets-hackers.html">View post<span aria-hidden="true"> ›</span><span class="sr-only"> (permalink): SonicWall firewall exploit lets hackers hijack VPN sessions, patch now …</span></a></div> </div></article></li> <li class="ti-item"><article class="h-entry"> <div class="ti-item-context"> <p class="ti-source-label"><span class="ti-context-label">Source</span><span>hackread.com</span></p> <p class="ti-curation-date"><span class="ti-context-label">Curated</span><time class="dt-published" datetime="2025-02-11T23:49:35-04:00">Feb 11, 2025</time></p> </div> <div class="ti-item-content"> <div class="post-body e-content"><h2 class="ti-source-headline p-name"><a href="https://hackread.com/cisco-rejects-kraken-ransomware-data-breach-claim/">Cisco Rejects Kraken Ransomware’s Data Breach Claims</a></h2> <p>Cisco denies recent data breach claims by the Kraken ransomware group, stating the leaked credentials are from a resolved 2022 incident. The company asserts the exposed information, including usernames, domains, and hashed passwords, poses no risk to customers. While the incident highlights the prevalence of credential-based cyberattacks, Cisco maintains the breach was contained and resolved.</p> </div> <div class="ti-meta"><a class="u-url" href="https://threatintel.cc/2025/02/11/cisco-rejects-kraken-ransomwares-data.html">View curation<span aria-hidden="true"> ›</span><span class="sr-only"> (permalink): Cisco Rejects Kraken Ransomware’s Data Breach Claims Cisco denies recent data breach claims by the …</span></a></div> </div></article></li> <li class="ti-item"><article class="h-entry"> <div class="ti-item-context"> <p class="ti-source-label"><span class="ti-context-label">Source</span><span>www.cyber.gc.ca</span></p> <p class="ti-curation-date"><span class="ti-context-label">Curated</span><time class="dt-published" datetime="2025-02-11T23:48:08-04:00">Feb 11, 2025</time></p> </div> <div class="ti-item-content"> <div class="post-body e-content"><h2 class="ti-source-headline p-name"><a href="https://www.cyber.gc.ca/en/alerts-advisories/sap-security-advisory-february-2025-monthly-rollup-av25-073">SAP security advisory – February 2025 monthly rollup (AV25-073) - Canadian Centre for Cyber Security</a></h2> </div> <div class="ti-meta"><a class="u-url" href="https://threatintel.cc/2025/02/11/sap-security-advisory-february-monthly.html">View curation<span aria-hidden="true"> ›</span><span class="sr-only"> (permalink): SAP security advisory – February 2025 monthly rollup (AV25-073) - Canadian Centre for Cyber Security …</span></a></div> </div></article></li> <li class="ti-item"><article class="h-entry"> <div class="ti-item-context"> <p class="ti-source-label"><span class="ti-context-label">Source</span><span>www.cyber.gc.ca</span></p> <p class="ti-curation-date"><span class="ti-context-label">Curated</span><time class="dt-published" datetime="2025-02-11T23:47:56-04:00">Feb 11, 2025</time></p> </div> <div class="ti-item-content"> <div class="post-body e-content"><h2 class="ti-source-headline p-name"><a href="https://www.cyber.gc.ca/en/alerts-advisories/ivanti-security-advisory-av25-074">Ivanti security advisory (AV25-074) - Canadian Centre for Cyber Security</a></h2> </div> <div class="ti-meta"><a class="u-url" href="https://threatintel.cc/2025/02/11/ivanti-security-advisory-av-canadian.html">View curation<span aria-hidden="true"> ›</span><span class="sr-only"> (permalink): Ivanti security advisory (AV25-074) - Canadian Centre for Cyber Security </span></a></div> </div></article></li> <li class="ti-item"><article class="h-entry"> <div class="ti-item-context"> <p class="ti-source-label"><span class="ti-context-label">Source</span><span>www.cyber.gc.ca</span></p> <p class="ti-curation-date"><span class="ti-context-label">Curated</span><time class="dt-published" datetime="2025-02-11T23:47:45-04:00">Feb 11, 2025</time></p> </div> <div class="ti-item-content"> <div class="post-body e-content"><h2 class="ti-source-headline p-name"><a href="https://www.cyber.gc.ca/en/alerts-advisories/fortinet-security-advisory-av25-075">Fortinet security advisory (AV25-075) - Canadian Centre for Cyber Security</a></h2> </div> <div class="ti-meta"><a class="u-url" href="https://threatintel.cc/2025/02/11/fortinet-security-advisory-av-canadian.html">View curation<span aria-hidden="true"> ›</span><span class="sr-only"> (permalink): Fortinet security advisory (AV25-075) - Canadian Centre for Cyber Security </span></a></div> </div></article></li> <li class="ti-item"><article class="h-entry"> <div class="ti-item-context"> <p class="ti-source-label"><span class="ti-context-label">Source</span><span>www.cyber.gc.ca</span></p> <p class="ti-curation-date"><span class="ti-context-label">Curated</span><time class="dt-published" datetime="2025-02-11T23:28:08-04:00">Feb 11, 2025</time></p> </div> <div class="ti-item-content"> <div class="post-body e-content"><h2 class="ti-source-headline p-name"><a href="https://www.cyber.gc.ca/en/alerts-advisories/microsoft-security-advisory-february-2025-monthly-rollup-av25-076">Microsoft security advisory – February 2025 monthly rollup (AV25–076) - Canadian Centre for Cyber Security</a></h2> </div> <div class="ti-meta"><a class="u-url" href="https://threatintel.cc/2025/02/11/microsoft-security-advisory-february-monthly.html">View curation<span aria-hidden="true"> ›</span><span class="sr-only"> (permalink): Microsoft security advisory – February 2025 monthly rollup (AV25–076) - Canadian Centre for Cyber …</span></a></div> </div></article></li> <li class="ti-item"><article class="h-entry"> <div class="ti-item-context"> <p class="ti-source-label"><span class="ti-context-label">Source</span><span>www.cyber.gc.ca</span></p> <p class="ti-curation-date"><span class="ti-context-label">Curated</span><time class="dt-published" datetime="2025-02-11T23:26:59-04:00">Feb 11, 2025</time></p> </div> <div class="ti-item-content"> <div class="post-body e-content"><h2 class="ti-source-headline p-name"><a href="https://www.cyber.gc.ca/en/alerts-advisories/adobe-security-advisory-av25-077">Adobe security advisory (AV25–077) - Canadian Centre for Cyber Security</a></h2> </div> <div class="ti-meta"><a class="u-url" href="https://threatintel.cc/2025/02/11/adobe-security-advisory-av-canadian.html">View curation<span aria-hidden="true"> ›</span><span class="sr-only"> (permalink): Adobe security advisory (AV25–077) - Canadian Centre for Cyber Security </span></a></div> </div></article></li> <li class="ti-item"><article class="h-entry"> <div class="ti-item-context"> <p class="ti-source-label"><span class="ti-context-label">Source</span><span>www.shelltrail.com</span></p> <p class="ti-curation-date"><span class="ti-context-label">Curated</span><time class="dt-published" datetime="2025-02-11T23:26:21-04:00">Feb 11, 2025</time></p> </div> <div class="ti-item-content"> <div class="post-body e-content"><h2 class="ti-source-headline p-name"><a href="https://www.shelltrail.com/research/how-auto-generated-passwords-in-sitevision-leads-to-signing-key-leakage-cve-2022-35202/">How auto-generated passwords in Sitevision leads to signing key leakage - CVE-2022-35202 | Shelltrail - Swedish offensive security experts</a></h2> <p>A vulnerability in Sitevision CMS allows remote attackers to access private keys used for signing SAML Authn requests. The issue arises from a low-complexity, auto-generated password protecting the Java keystore containing these keys, which can be cracked offline. While the impact is difficult to assess, it highlights the importance of strong password complexity and proper configuration for sensitive data protection.</p> </div> <div class="ti-meta"><a class="u-url" href="https://threatintel.cc/2025/02/11/how-autogenerated-passwords-in-sitevision.html">View curation<span aria-hidden="true"> ›</span><span class="sr-only"> (permalink): How auto-generated passwords in Sitevision leads to signing key leakage - CVE-2022-35202 | …</span></a></div> </div></article></li> <li class="ti-item"><article class="h-entry"> <div class="ti-item-context"> <p class="ti-source-label"><span class="ti-context-label">Source</span><span>securityaffairs.com</span></p> <p class="ti-curation-date"><span class="ti-context-label">Curated</span><time class="dt-published" datetime="2025-02-11T23:25:37-04:00">Feb 11, 2025</time></p> </div> <div class="ti-item-content"> <div class="post-body e-content"><h2 class="ti-source-headline p-name"><a href="https://securityaffairs.com/174111/security/openssl-patched-the-vulnerability-cve-2024-12797.html">OpenSSL patched high-severity flaw CVE-2024-12797</a></h2> <p>OpenSSL patched a high-severity vulnerability, CVE-2024-12797, that allowed man-in-the-middle attacks on TLS connections using raw public keys. The vulnerability, discovered by Apple, impacted OpenSSL 3.2, 3.3, and 3.4 and was fixed in versions 3.2.4, 3.3.2, and 3.4.1. This vulnerability highlights the importance of secure communication protocols and regular software updates.</p> </div> <div class="ti-meta"><a class="u-url" href="https://threatintel.cc/2025/02/11/openssl-patched-highseverity-flaw-cve.html">View curation<span aria-hidden="true"> ›</span><span class="sr-only"> (permalink): OpenSSL patched high-severity flaw CVE-2024-12797 OpenSSL patched a high-severity vulnerability, …</span></a></div> </div></article></li> <li class="ti-item"><article class="h-entry"> <div class="ti-item-context"> <p class="ti-source-label"><span class="ti-context-label">Source</span><span>www.cyber.gc.ca</span></p> <p class="ti-curation-date"><span class="ti-context-label">Curated</span><time class="dt-published" datetime="2025-02-11T23:25:07-04:00">Feb 11, 2025</time></p> </div> <div class="ti-item-content"> <div class="post-body e-content"><h2 class="ti-source-headline p-name"><a href="https://www.cyber.gc.ca/en/alerts-advisories/hpe-security-advisory-av25-078">HPE security advisory (AV25-078) - Canadian Centre for Cyber Security</a></h2> </div> <div class="ti-meta"><a class="u-url" href="https://threatintel.cc/2025/02/11/hpe-security-advisory-av-canadian.html">View curation<span aria-hidden="true"> ›</span><span class="sr-only"> (permalink): HPE security advisory (AV25-078) - Canadian Centre for Cyber Security </span></a></div> </div></article></li> <li class="ti-item"><article class="h-entry"> <div class="ti-item-context"> <p class="ti-source-label"><span class="ti-context-label">Source</span><span>hackread.com</span></p> <p class="ti-curation-date"><span class="ti-context-label">Curated</span><time class="dt-published" datetime="2025-02-11T23:24:42-04:00">Feb 11, 2025</time></p> </div> <div class="ti-item-content"> <div class="post-body e-content"><h2 class="ti-source-headline p-name"><a href="https://hackread.com/omnigpt-ai-chatbot-breach-hacker-leak-user-data-messages/">OmniGPT AI Chatbot Alleged Breach: Hacker Leaks User Data, 34M Messages</a></h2> <p>A hacker claims to have breached OmniGPT, an AI-powered chatbot and productivity platform, exposing over 30,000 user emails, phone numbers, and 34 million lines of chat messages. The leaked data includes sensitive information like API keys, credentials, and file links, potentially leading to identity theft, phishing, and financial fraud. OmniGPT has yet to issue an official response to the alleged breach.</p> </div> <div class="ti-meta"><a class="u-url" href="https://threatintel.cc/2025/02/11/omnigpt-ai-chatbot-alleged-breach.html">View curation<span aria-hidden="true"> ›</span><span class="sr-only"> (permalink): OmniGPT AI Chatbot Alleged Breach: Hacker Leaks User Data, 34M Messages A hacker claims to have …</span></a></div> </div></article></li> <li class="ti-item"><article class="h-entry"> <div class="ti-item-context"> <p class="ti-source-label"><span class="ti-context-label">Source</span><span>cyberscoop.com</span></p> <p class="ti-curation-date"><span class="ti-context-label">Curated</span><time class="dt-published" datetime="2025-02-11T23:24:04-04:00">Feb 11, 2025</time></p> </div> <div class="ti-item-content"> <div class="post-body e-content"><h2 class="ti-source-headline p-name"><a href="https://cyberscoop.com/microsoft-patch-tuesday-february-2025/">Microsoft fixes 63 vulnerabilities, including 2 zero-days | CyberScoop</a></h2> <p>Microsoft released a security update addressing 63 vulnerabilities, including two zero-day flaws. One zero-day allows attackers to delete targeted files on a system, while the other enables privilege escalation and system compromise. Nine vulnerabilities are rated as “more likely” to be exploited, including remote-code execution flaws in Microsoft SharePoint Server and Windows Telephony Service.</p> </div> <div class="ti-meta"><a class="u-url" href="https://threatintel.cc/2025/02/11/microsoft-fixes-vulnerabilities-including-zerodays.html">View curation<span aria-hidden="true"> ›</span><span class="sr-only"> (permalink): Microsoft fixes 63 vulnerabilities, including 2 zero-days | CyberScoop Microsoft released a security …</span></a></div> </div></article></li> <li class="ti-item"><article class="h-entry"> <div class="ti-item-context"> <p class="ti-source-label"><span class="ti-context-label">Source</span><span>securityaffairs.com</span></p> <p class="ti-curation-date"><span class="ti-context-label">Curated</span><time class="dt-published" datetime="2025-02-11T23:23:15-04:00">Feb 11, 2025</time></p> </div> <div class="ti-item-content"> <div class="post-body e-content"><h2 class="ti-source-headline p-name"><a href="https://securityaffairs.com/174117/hacking/fortinet-fortios-zero-day-exploited.html">Attackers exploit a new zero-day to hijack Fortinet firewalls</a></h2> <p>Threat actors are exploiting a new zero-day vulnerability in FortiOS and FortiProxy to hijack Fortinet firewalls. The vulnerability, CVE-2025-24472, allows remote attackers to gain super-admin privileges by making maliciously crafted CSF proxy requests. Arctic Wolf researchers observed a campaign involving unauthorized logins, account creation, and configuration changes on Fortinet FortiGate firewalls, likely exploiting this zero-day flaw.</p> </div> <div class="ti-meta"><a class="u-url" href="https://threatintel.cc/2025/02/11/attackers-exploit-a-new-zeroday.html">View curation<span aria-hidden="true"> ›</span><span class="sr-only"> (permalink): Attackers exploit a new zero-day to hijack Fortinet firewalls Threat actors are exploiting a new …</span></a></div> </div></article></li> <li class="ti-item"><article class="h-entry"> <div class="ti-item-context"> <p class="ti-curation-date"><span class="ti-context-label">Published</span><time class="dt-published" datetime="2025-02-11T09:07:44-04:00">Feb 11, 2025</time></p> </div> <div class="ti-item-content"> <div class="post-body e-content"><p>Malware from fake recruiters <a href="https://www.gdatasoftware.com/blog/2025/02/38143-malware-fake-recruiters">www.gdatasoftware.com/blog/2025…</a></p> <p>Fake recruiters are currently on the hunt for CVs – and also your data. Reports have emerged about malware being put into work assignments that supposedly test a candidate’s technical skills.</p> <p>Recruiters are in a constant struggle to find matches for their job openings. Be it via classic job ads online, or via DM on platforms like LinkedIn.</p> <p>We have recently discovered a report by several users on Reddit who says that they have been contacted by a recruiter and given a task to create a work sample. This practice is not uncommon, though it has been claimed in the past that some companies use this tactic to take advantage of applicants and get production work done for free. But on the whole, companies want to see that you are capable of doing what your resume says. This case, however, was interesting. From the fact that you are reading this post on the blog of a company that fights malware, you can probably guess where this is going. But let’s not get ahead of ourselves.</p> </div> <div class="ti-meta"><a class="u-url" href="https://threatintel.cc/2025/02/11/080744.html">View post<span aria-hidden="true"> ›</span><span class="sr-only"> (permalink): Malware from fake recruiters www.gdatasoftware.com/blog/2025&hellip; Fake recruiters are currently …</span></a></div> </div></article></li> <li class="ti-item"><article class="h-entry"> <div class="ti-item-context"> <p class="ti-curation-date"><span class="ti-context-label">Published</span><time class="dt-published" datetime="2025-02-11T09:07:13-04:00">Feb 11, 2025</time></p> </div> <div class="ti-item-content"> <div class="post-body e-content"><p>Sky ECC encrypted service distributors arrested in Spain, Netherlands <a href="https://www.bleepingcomputer.com/news/legal/sky-ecc-encrypted-service-distributors-arrested-in-spain-netherlands/">www.bleepingcomputer.com/news/lega…</a></p> <p>Four distributors of the encrypted communications service Sky ECC, used extensively by criminals, were arrested in Spain and the Netherlands.</p> <p>According to an announcement by the Spanish police, the two suspects arrested in the country were the leading global distributors of the service, generating over €13.5 million ($14M) in profits.</p> <p>In March 2021, Europol announced that it had cracked Sky ECC’s encryption, allowing investigators to monitor the communications of 70,000 users, revealing extensive criminal activity.</p> <p>Today, the police in Spain announced the apprehension of two leading sellers of the Sky ECC service and the confiscation of money and key items.</p> <p>The search and arrest operation took place in late January 2025 in Jávea (Alicante) and Ibiza.</p> <p>The police in the Netherlands reported on January 31, 2025, that they arrested two men in Amsterdam and Arnhem. The two were high-ranking sellers of the service, reportedly having direct contact with the platform’s CEO for years.</p> </div> <div class="ti-meta"><a class="u-url" href="https://threatintel.cc/2025/02/11/sky-ecc-encrypted-service-distributors.html">View post<span aria-hidden="true"> ›</span><span class="sr-only"> (permalink): Sky ECC encrypted service distributors arrested in Spain, Netherlands …</span></a></div> </div></article></li> <li class="ti-item"><article class="h-entry"> <div class="ti-item-context"> <p class="ti-curation-date"><span class="ti-context-label">Published</span><time class="dt-published" datetime="2025-02-11T09:06:58-04:00">Feb 11, 2025</time></p> </div> <div class="ti-item-content"> <div class="post-body e-content"><p>4 Arrested as Police Dismantle 8Base Ransomware, Seize Dark Web Sites <a href="https://hackread.com/police-dismantle-8base-ransomware-seize-dark-web-sites/">hackread.com/police-di…</a></p> <p>International law enforcement agencies have seized the dark web infrastructure of the notorious 8Base ransomware group and arrested four suspected members, including two men and two women.</p> <p>The operation, led by the Bavarian State Criminal Police Office and the Office of the Public Prosecutor General in Bamberg, targeted the group’s TOR-based leak site used to publish stolen data and pressure victims into paying ransoms.</p> <p>According to a Thai media report, the arrests, carried out in Phuket, Thailand, targeted individuals believed to be part of the Phobos ransomware gang, the malware family linked to 8Base’s operations. The suspects are accused of carrying cyberattacks against over 1,000 victims worldwide, marking a big win in the ongoing fight against ransomware.</p> </div> <div class="ti-meta"><a class="u-url" href="https://threatintel.cc/2025/02/11/arrested-as-police-dismantle-base.html">View post<span aria-hidden="true"> ›</span><span class="sr-only"> (permalink): 4 Arrested as Police Dismantle 8Base Ransomware, Seize Dark Web Sites hackread.com/police-di&hellip; …</span></a></div> </div></article></li> </ul> <nav class="pagination" aria-label="Post pagination"> <a class="newer-posts" href="/page/192/">← Newer posts</a> <span class="page-number">Page 193 of 231</span> <a class="older-posts" href="/page/194/">Older posts →</a> </nav> </div></main> <footer id="footer"><div class="ti-footer-inner"><a class="ti-brand" href="/">Threat Intel</a> <nav aria-label="Footer navigation"><a href="/about">About</a><a href="/contact">Contact</a><a href="/privacy">Privacy</a><a href="/feed.xml">RSS</a><a href="/feed.json">JSON Feed</a></nav> <p class="ti-copyright">© 2026 Threat Intel</p></div></footer> <script src="/js/external-links.min.js?v=31"></script> </body></html>

Security. In focus.

Palo Alto Networks security advisory (AV25-081) - Canadian Centre for Cyber Security

Reflected XSS In Main Search, WAF+Sanitizer Bypass Using 2 Reflections | by Renwa | Feb, 2025 | Medium