Security. In focus.

New backdoor ‘SesameOp’ abuses OpenAI Assistants API for stealthy C2 operations | CSO Online

Microsoft has uncovered a new backdoor named SesameOp that exploits the OpenAI Assistants API for covert command-and-control operations, making detection difficult by using legitimate API functions. This method bypasses traditional detection methods by masking malicious traffic as benign API calls to api.openai.com.

Former ransomware negotiators allegedly targeted US firms with ALPHV/BlackCat ransomware - Help Net Security

Two individuals, a former ransomware negotiator and an incident response manager, have been indicted for allegedly deploying the ALPHV/BlackCat ransomware against US companies, extorting nearly $1.3 million from one victim. The indictment charges them with conspiracy and extortion, detailing their alleged partnership with the ransomware group to infiltrate and extort at least five organizations between May 2023 and April 2025.

Data Theft Hits Behavioral Health Network in 3 States

A data theft incident at Oglethorpe Inc., a behavioral health network operating in Florida, Ohio, and Louisiana, has potentially exposed the personal and health information of over 92,000 patients. The company discovered the breach on June 6 and is offering affected individuals 12 months of free credit monitoring, while also cooperating with law enforcement and bolstering its network security measures.

BadCandy Implant Hits Cisco Devices Across Australia

The Australian Cyber Security Centre has warned of a BadCandy implant targeting unpatched Cisco IOS XE devices, with at least 150 compromised in Australia. Hackers exploit zero-day vulnerabilities (CVE-2023-20198 and CVE-2023-20273) to create administrator accounts and deploy the web shell, a tactic attributed to Chinese nation-state hackers known as Salt Typhoon.

US Appeals Court lowers burden of proof for data breach lawsuits | CSO Online

The 4th US Circuit Court of Appeals has lowered the burden of proof for data breach lawsuits, ruling that publication of stolen data on the dark web alone may be sufficient to prove damages. This decision could increase lawsuit exposure for breached companies and alter the risk calculus for CISOs, potentially motivating attackers to extort higher ransoms.

New HttpTroy Backdoor Poses as VPN Invoice in Targeted Cyberattack on South Korea

A North Korea-linked threat actor, Kimsuky, has deployed a new backdoor named HttpTroy in a targeted cyberattack on South Korea, masquerading as a VPN invoice to deliver malware. Simultaneously, the Lazarus Group attacked two victims in Canada, deploying Comebacker and an upgraded BLINDINGCAN remote access trojan, showcasing the evolving sophistication of DPRK-linked actors.

Hacktivists increasingly target industrial control systems, Canada Cyber Centre warns | CSO Online

The Canada Cyber Centre warns that hacktivists are increasingly targeting industrial control systems (ICS) in critical sectors like water, oil and gas, and agriculture. Real-world attacks have involved tampering with water pressure, manipulating fuel tank gauges, and altering temperature/humidity in grain silos, highlighting the risks of internet-exposed ICS devices.

Rhysida ransomware exploits Microsoft certificate to slip malware past defenses | CSO Online

The Rhysida ransomware gang is exploiting Microsoft’s trusted signing system to distribute its OysterLoader malware through fake search ads, bypassing security defenses by using digitally signed files that appear legitimate. This tactic, combined with obfuscation techniques, allows the malware to gain initial access and establish persistence, complicating detection and investigations for defenders who must now treat signed files with suspicion and focus on behavioral analytics.

Cyber-espionage campaign mirroring Sandworm TTPs hit Russian and Belarusian military - Help Net Security

A spear-phishing campaign is targeting Russian and Belarusian military personnel, using military-themed documents as lures to deliver malicious LNK files. Researchers note similarities to past campaigns linked to the Sandworm team, though attribution remains unconfirmed.

You may be getting a notice that your personal info was leaked in a Conduent data breach. Here’s why | wfaa.com

More than ten million individuals had sensitive personal and health-related data stolen during a prolonged breach of Conduent’s systems. Attackers accessed the network in October 2024 and were only detected and removed in January 2025. Impacted information includes Social Security numbers, medical details, and insurance data. Conduent has begun notifying affected parties but is not offering identity-theft monitoring, instead advising credit checks and freezes. The company reports no confirmed fraudulent use to date.

Scans for Port 8530/8531 (TCP). Likely related to WSUS Vulnerability CVE-2025-59287 isc.sans.edu/diary/rss…

Sensors reporting firewall logs detected a significant increase in scans for port 8530/TCP and 8531/TCP over the course of last week. Some of these reports originate from Shadowserver, and likely other researchers, but there are also some that do not correspond to known research-related IP addresses.

CVE-2025-59287 is exploited by connecting to affected WSUS servers on port 8530/TCP (non-TLS) or 8531/TCP (TLS). Once connected, an attacker could exploit the vulnerability to execute scripts on a vulnerable server. Typically, an attacker begins by conducting reconnaissance and subsequently follows up with a network compromise.

Sufficient details have been made public about the attack to suggest that any exposed vulnerable servers should be considered compromised at this point.

Drawn to Danger: Windows Graphics Vulnerabilities Lead to Remote Code Execution and Memory Exposure research.checkpoint.com/2025/draw…

Check Point Research (CPR) identified three security vulnerabilities in the Graphics Device Interface (GDI) in Windows. We promptly reported these issues to Microsoft, and they were addressed in the Patch Tuesday updates in May, July, and August 2025.

Vulnerability disclosures such as these highlight the need for proactive measures to mitigate potential risks. Our purpose in publishing this blog after security fixes were implemented is to further raise awareness of these vulnerabilities and provide Windows users with defensive insights and mitigation recommendations. In the following sections, we detail the findings of our fuzzing campaign, which targeted Windows GDI using the EMF format and led to the discovery of these security vulnerabilities.

University of Pennsylvania says it wasn’t hacked after a vulgar email was sent to campus community – DataBreaches.Net

The University of Pennsylvania is investigating a fraudulent email sent to its community, urging recipients to stop giving money. The email, sent from various Penn-affiliated accounts, falsely claimed the university was hacked and threatened to leak student data.

Veradigm’s Breach Claims Under Scrutiny After Dark Web Leak – DataBreaches.Net

A data breach affecting Veradigm LLC, a health information technology company, has come under scrutiny after a dark web leak. The breach, which occurred on December 15, 2024, involved unauthorized access to client data stored in a compromised account, leading to potential exposure of sensitive information including names, contact details, dates of birth, health records, insurance information, payment details, and Social Security numbers. A class-action lawsuit, Goodrum v. Veradigm, has been filed and is likely to be settled.

(Web-)Insecurity Blog | Dead Domain Discovery: Discover Expired or Unregistered Domains

Two tools, a Chrome extension and a DNS forwarder, were created to help identify expired or unregistered domains. The Chrome extension scans for abandoned domains referenced by websites, while the DNS forwarder highlights potentially expired domains by watching for unanswered lookups. Both tools are open source and available on GitHub.

China-linked UNC6384 exploits Windows zero-day to spy on European diplomats

China-linked APT group UNC6384 is exploiting a Windows zero-day vulnerability (ZDI-CAN-25373) to spy on European diplomats, using sophisticated techniques like DLL side-loading and PlugX RAT deployment. The campaign, which began in September 2025, targets diplomatic entities in countries including Hungary, Belgium, Serbia, Italy, and the Netherlands with lures themed around EU and NATO events.

New Kurdish Hacktivists Hezi Rash Behind 350 DDoS Attacks in 2 Months – Hackread – Cybersecurity News, Data Breaches, Tech, AI, Crypto and More

A new hacktivist group called Hezi Rash has conducted approximately 350 DDoS attacks in two months, targeting countries perceived as threats to Kurdish or Muslim communities. This group, which emerged in 2023, utilizes DDoS-as-a-Service platforms and collaborates with other hacktivist collectives, highlighting a growing trend in politically motivated cyberattacks.

BadCandy Webshell threatens unpatched Cisco IOS XE devices, warns Australian government

The Australian government has issued a warning regarding the BadCandy webshell, which is actively exploiting an unpatched vulnerability (CVE-2023-20198) in Cisco IOS XE devices. This exploit allows attackers to gain administrator privileges and install the webshell, with hundreds of devices in Australia already compromised.

Ukrainian extradited to US over Conti ransomware involvement

A Ukrainian national, Oleksii Lytvynenko, has been extradited from Ireland to the US to face charges for his alleged involvement in Conti ransomware attacks. He is accused of deploying the ransomware to extort over $500,000 from US victims and potentially millions globally, facing up to 25 years in prison if convicted.

Denmark Withdraws Chat Control Proposal Amid Controversy

Denmark withdrew its proposal for mandatory client-side scanning of communications and files for child sexual abuse material (CSAM) after facing domestic and international opposition. The proposal, known as Chat Control, faced opposition from Germany, the Danish Moderates, and other countries, while France and Ireland supported it.

Proton Exposes 300 Million Stolen Credentials — 49% Include Passwords

Privacy company Proton has uncovered 300 million stolen credentials on the dark web, with 49% of them including passwords. This exposure highlights the ongoing risks associated with password reuse and phishing attacks, even as the industry moves towards passwordless solutions.

Russia Arrests Meduza Stealer Developers After Government Hack – Hackread – Cybersecurity News, Data Breaches, Tech, AI, Crypto and More

Russian law enforcement arrested three IT specialists suspected of developing and selling the Meduza Stealer malware, a Malware-as-a-Service operation active since mid-2023. The crackdown followed the group’s alleged breach of a Russian government organization, a move that violated their malware’s own geo-filter designed to avoid domestic targets.

Massive Great Firewall Leak Exposes 500GB of Censorship Data – DataBreaches.Net

A massive leak of over 500GB of data from Chinese infrastructure firms associated with the Great Firewall has exposed internal source code, operational documents, and details on how censorship tools are tested against circumvention methods like VPNs and Tor. This historic breach, estimated to be closer to 600GB, includes over 100,000 documents and project management data.

Nearly 58 billion personal data points have been leaked online since 2004, new study reveals | TechRadar

A new study reveals that 57.8 billion personal data points have been leaked online since 2004, with passwords being the most common type of exposed information. The United States is the most affected country, accounting for nearly 19 billion of these leaked data points.

Hackers threaten to leak data after breaching University of Pennsylvania to send mass emails | TechCrunch

The University of Pennsylvania experienced a data breach where hackers sent mass emails from university accounts, threatening to leak data and citing FERPA violations. The hackers' motive appears to be suppressing alumni donations, potentially linked to Penn’s rejection of the White House’s Compact for Academic Excellence.