admin

admin

  • Joined: September 10, 2024
  • Articles: 5489

U.S. and U.K. Alert on Russian Hackers Utilizing Cisco Router Vulnerabilities for Espionage

April 19, 2023
Network Security / Cyber Espionage

Cybersecurity and intelligence agencies from the U.S. and U.K. have issued a warning about Russian state-sponsored actors exploiting recently patched vulnerabilities in Cisco networking equipment for reconnaissance and malware deployment against specific targets. These intrusions occurred in 2021 and affected a limited number of entities across Europe, U.S. government agencies, and around 250 Ukrainian victims. The activity has been linked to the threat group APT28, also known as Fancy Bear, Forest Blizzard (formerly Strontium), FROZENLAKE, and Sofacy, which is connected to the Russian General Staff Main Intelligence Directorate (GRU). The National Cyber Security Centre (NCSC) noted that APT28 gained access to vulnerable routers using default and weak SNMP community strings, as well as by exploiting CVE-2017-6742, a remote code execution vulnerability with a CVSS score of 8.8.

U.S. and U.K. Governments Alert on Russian Cyber Actors Exploiting Cisco Vulnerabilities On April 19, 2023, cybersecurity and intelligence agencies from the United States and the United Kingdom issued a warning regarding the activities of Russian state-sponsored hackers. These actors…

Nevada State Offices Suspend Services Following Cyber Incident

Incident & Breach Response, Security Operations Nevada Faces Widespread IT Disruption, Leading to Service Suspension Chris Riotta (@chrisriotta) • August 25, 2025 Image: Alexander Lukatskiy/Shutterstock Nevada state agencies have suspended several in-person services as a result of a network security…

159 CVEs Reported Exploited in Q1 2025 — 28.3% Targeted Within 24 Hours of Disclosure

April 24, 2025
Vulnerability / Threat Intelligence

In the first quarter of 2025, a total of 159 CVE identifiers have been identified as actively exploited, a rise from 151 in the previous quarter. According to a report from VulnCheck shared with The Hacker News, the pace of exploitation remains rapid, with 28.3% of these vulnerabilities being targeted within a day of their disclosure. This accounts for 45 security flaws weaponized in real-world attacks shortly after being revealed. An additional 14 vulnerabilities were exploited within a month, while another 45 were abused over the course of a year. The majority of these vulnerabilities were found in content management systems (CMS), followed by network edge devices, operating systems, open-source software, and server software. Breakdown includes:

  • Content Management Systems (CMS): 35
  • Network Edge Devices: 29
  • Operating Systems: 24
  • Open Source Software: 14
  • Server Software: 14

159 CVEs Exploited in Q1 2025—28.3% Within 24 Hours of Disclosure April 24, 2025 In the first quarter of 2025, a total of 159 Common Vulnerabilities and Exposures (CVEs) have been identified as actively exploited, a notable increase from 151…

Over 100,000 WordPress Sites Vulnerable to Critical CVSS 10.0 Flaw in TI WooCommerce Wishlist Plugin

May 29, 2025 Vulnerability / Website Security

Cybersecurity experts have revealed a severe, unpatched security vulnerability affecting the TI WooCommerce Wishlist plugin for WordPress. This flaw can be exploited by unauthenticated attackers to upload arbitrary files. The TI WooCommerce Wishlist, with over 100,000 active installations, allows e-commerce customers to save their favorite products and share their lists on social media.

According to Patchstack researcher John Castro, “The plugin is susceptible to an arbitrary file upload vulnerability, enabling attackers to upload malicious files to the server without any authentication.” Identified as CVE-2025-47577, this vulnerability has a CVSS score of 10.0 and affects all versions up to and including 2.9.2, released on November 29, 2024. Currently, no patch is available. The website security firm pointed out that the vulnerability is linked to a function called “tinvwl_upload_file_wc_fields_factory,” which utilizes another native WordPress…

Over 100,000 WordPress Sites Vulnerable Due to Critical Flaw in Wishlist Plugin May 29, 2025 Vulnerability / Website Security A significant cybersecurity threat has emerged involving a critical security vulnerability in the TI WooCommerce Wishlist plugin for WordPress. Currently used…

Pakistani Hackers Deploy Linux Malware “Poseidon” to Target Indian Government Entities

April 19, 2023
Linux / Malware

The Pakistan-based advanced persistent threat (APT) group known as Transparent Tribe has exploited a two-factor authentication (2FA) tool utilized by Indian government agencies to introduce a new Linux backdoor dubbed Poseidon. According to Uptycs security researcher Tejaswini Sandapolla, “Poseidon serves as a second-stage malware payload linked to Transparent Tribe. It functions as a versatile backdoor, enabling attackers to perform a variety of malicious actions such as logging keystrokes, capturing screenshots, and managing system files remotely.” Transparent Tribe, also identified as APT36, Operation C-Major, PROJECTM, and Mythic Leopard, has a history of targeting Indian governmental bodies, military personnel, defense contractors, and educational institutions. This group frequently utilizes trojanized versions of legitimate software to carry out its attacks.

Pakistani Hackers Employ Linux Malware “Poseidon” to Compromise Indian Government Networks On April 19, 2023, cybersecurity researchers reported that a prominent threat actor from Pakistan, known as Transparent Tribe, has utilized a fraudulent two-factor authentication (2FA) tool to deploy a…