The Breach News

WikiLeaks Under Siege: DDoS Attack Strikes Again

Dec 01, 2010

WikiLeaks experienced a significant distributed denial of service (DDoS) attack on Tuesday morning, as detailed by Fast Company. This assault was more severe than a previous one on Sunday, yet it failed to completely disrupt the site. The perpetrator, a hacker known as “The Jester,” took credit for the cyber attack that targeted WikiLeaks just before it released a trove of classified U.S. embassy cables.

The Jester, an ex-soldier, defended his actions by alleging that WikiLeaks was “endangering the lives of our troops, ‘other assets,’ and foreign relations.” After his military service, he positioned himself as a “hacktivist for good,” aiming to combat terrorism and groups linked to Islamic extremism. Cybersecurity expert Mikko Hypponen from F-Secure expressed belief that The Jester was indeed the mastermind behind the attack.

WikiLeaks Targeted by Intensified DDoS Attack On December 1, 2010, WikiLeaks experienced a significant distributed denial of service (DDoS) attack early in the morning, amplifying the cyber challenges faced by the organization following a previous incident just days prior. While this latest attack proved to be more severe than the…

Read More

WikiLeaks Under Siege: DDoS Attack Strikes Again

Dec 01, 2010

WikiLeaks experienced a significant distributed denial of service (DDoS) attack on Tuesday morning, as detailed by Fast Company. This assault was more severe than a previous one on Sunday, yet it failed to completely disrupt the site. The perpetrator, a hacker known as “The Jester,” took credit for the cyber attack that targeted WikiLeaks just before it released a trove of classified U.S. embassy cables.

The Jester, an ex-soldier, defended his actions by alleging that WikiLeaks was “endangering the lives of our troops, ‘other assets,’ and foreign relations.” After his military service, he positioned himself as a “hacktivist for good,” aiming to combat terrorism and groups linked to Islamic extremism. Cybersecurity expert Mikko Hypponen from F-Secure expressed belief that The Jester was indeed the mastermind behind the attack.

Open Source Package with 1 Million Monthly Downloads Compromises User Credentials

Urgent Security Advisory for Developers: Action Required After Vulnerability Discovered A significant security incident has emerged involving version 0.23.3 of the popular elementary-data Python package, compelling developers who have installed this version to undertake immediate mitigation measures. Users are advised to conduct a review of their installed software to ascertain…

Read MoreOpen Source Package with 1 Million Monthly Downloads Compromises User Credentials

⚡ Weekly Roundup: NFC Scams, Curly COMrades, N-able Exploits, Docker Vulnerabilities & More

Aug 18, 2025
Cybersecurity / Hacking Insights

Power doesn’t vanish in a single breach; it gradually erodes through overlooked patches, misconfigured settings, and unmonitored systems. Security doesn’t fail in an instant; it declines slowly, then suddenly. Staying safe isn’t about knowing everything—it’s about taking swift, decisive action before issues accumulate. Clarity fosters control, while hesitation breeds risk. Below are this week’s key developments—each highlighting where prompt action is essential.

⚡ Threat of the Week

Ghost Tap NFC Mobile Fraud on the Rise
— A new Android Trojan, PhantomCard, has emerged as the latest malware targeting near-field communication (NFC) to execute relay attacks aimed at defrauding banking customers in Brazil. Users who inadvertently install the malicious app are guided to place their credit/debit card on the back of their phone to initiate verification, only for their card information to be transmitted to an attacker-controlled NFC relay…

Weekly Recap: NFC Fraud, Curly COMrades, N-able Exploits, Docker Backdoors & More In the ever-evolving landscape of cybersecurity, breaches and vulnerabilities often do not manifest in dramatic incidents but rather emerge in a series of overlooked details—missed patches, incorrect settings, or unmonitored systems. This gradual erosion of security often culminates…

Read More

⚡ Weekly Roundup: NFC Scams, Curly COMrades, N-able Exploits, Docker Vulnerabilities & More

Aug 18, 2025
Cybersecurity / Hacking Insights

Power doesn’t vanish in a single breach; it gradually erodes through overlooked patches, misconfigured settings, and unmonitored systems. Security doesn’t fail in an instant; it declines slowly, then suddenly. Staying safe isn’t about knowing everything—it’s about taking swift, decisive action before issues accumulate. Clarity fosters control, while hesitation breeds risk. Below are this week’s key developments—each highlighting where prompt action is essential.

⚡ Threat of the Week

Ghost Tap NFC Mobile Fraud on the Rise
— A new Android Trojan, PhantomCard, has emerged as the latest malware targeting near-field communication (NFC) to execute relay attacks aimed at defrauding banking customers in Brazil. Users who inadvertently install the malicious app are guided to place their credit/debit card on the back of their phone to initiate verification, only for their card information to be transmitted to an attacker-controlled NFC relay…

Urgent: New Chrome 0-Day Vulnerability Under Active Exploitation – Update Your Browser Immediately!

On March 3, 2021, just a month after addressing an actively exploited zero-day flaw, Google has released updates for another critical vulnerability in Chrome, which is reportedly being targeted by attackers. The latest version, Chrome 89.0.4389.72, available for Windows, Mac, and Linux, includes a total of 47 security enhancements. The most severe issue addresses an “object lifecycle problem in audio,” tracked as CVE-2021-21166. This vulnerability was among two reported by Alison Huffman of Microsoft Browser Vulnerability Research on February 11. A separate audio-related object lifecycle flaw was reported to Google on February 4, coinciding with the launch of Chrome 88. Though details are limited, it’s unclear whether the two issues are interconnected. Google has confirmed the existence of exploits in the wild but hasn’t provided further specifics. Users are urged to update their browsers without delay.

New Chrome Zero-Day Vulnerability Under Active Exploitation—Update Your Browser Immediately March 3, 2021 In a critical update, Google has announced the release of patches for a newly identified zero-day vulnerability within its Chrome web browser, which is reportedly being actively targeted by attackers. This follows just a month after the…

Read More

Urgent: New Chrome 0-Day Vulnerability Under Active Exploitation – Update Your Browser Immediately!

On March 3, 2021, just a month after addressing an actively exploited zero-day flaw, Google has released updates for another critical vulnerability in Chrome, which is reportedly being targeted by attackers. The latest version, Chrome 89.0.4389.72, available for Windows, Mac, and Linux, includes a total of 47 security enhancements. The most severe issue addresses an “object lifecycle problem in audio,” tracked as CVE-2021-21166. This vulnerability was among two reported by Alison Huffman of Microsoft Browser Vulnerability Research on February 11. A separate audio-related object lifecycle flaw was reported to Google on February 4, coinciding with the launch of Chrome 88. Though details are limited, it’s unclear whether the two issues are interconnected. Google has confirmed the existence of exploits in the wild but hasn’t provided further specifics. Users are urged to update their browsers without delay.

Indian Cyber Army Breaches OGRA Website in Retaliation

On December 4, 2010, the Indian Cyber Army executed a hack on the Oil & Gas Regulatory Authority (OGRA) website [www.ogra.org.pk] as part of an escalating cycle of cyberattacks. The website was quickly restored by its administrators. The defacement message claimed the attack was a response to the compromise of over 200 Indian websites by a group known as the Pakistan Cyber Army. The displayed message read: “You Have Been Hacked By The ‘INDIAN CYBER ARMY’. This Is a Retaliation Of Hacking ‘CBI’.” This incident follows an earlier wave of cyberattacks by Pakistani hackers, calling themselves ‘Predators PK,’ in response to a cyber offensive launched by the Indian Cyber Army (ICA), which they framed as revenge for the 26/11 attacks. Unlike the ICA, the Pakistani hackers did not present an ideological motive behind their assault.

Indian Cyber Army Compromises OGRA Website in Retaliatory Attack On December 4, 2010, the Indian Cyber Army, a notable group of hackers, successfully targeted the Oil & Gas Regulatory Authority (OGRA) website, located at www.ogra.org.pk. This incident forms part of an ongoing trend of cyber retaliation between Indian and Pakistani…

Read More

Indian Cyber Army Breaches OGRA Website in Retaliation

On December 4, 2010, the Indian Cyber Army executed a hack on the Oil & Gas Regulatory Authority (OGRA) website [www.ogra.org.pk] as part of an escalating cycle of cyberattacks. The website was quickly restored by its administrators. The defacement message claimed the attack was a response to the compromise of over 200 Indian websites by a group known as the Pakistan Cyber Army. The displayed message read: “You Have Been Hacked By The ‘INDIAN CYBER ARMY’. This Is a Retaliation Of Hacking ‘CBI’.” This incident follows an earlier wave of cyberattacks by Pakistani hackers, calling themselves ‘Predators PK,’ in response to a cyber offensive launched by the Indian Cyber Army (ICA), which they framed as revenge for the 26/11 attacks. Unlike the ICA, the Pakistani hackers did not present an ideological motive behind their assault.

Microsoft Windows Flaw Used to Launch PipeMagic RansomExx Malware

Cybersecurity researchers have revealed that threat actors are exploiting a now-patched vulnerability in Microsoft Windows to deploy the PipeMagic malware during RansomExx ransomware attacks. This exploitation hinges on CVE-2025-29824, a privilege escalation vulnerability affecting the Windows Common Log File System (CLFS), which Microsoft addressed in April 2025, according to a report from Kaspersky and BI.ZONE. First identified in 2022, PipeMagic has been utilized in RansomExx attacks targeting industrial sectors in Southeast Asia, functioning as a backdoor that allows remote access and execution of various commands on compromised systems. Past incidents have shown attackers exploiting CVE-2017-0144, a remote code execution vulnerability in Windows SMB, to breach victim networks. Notably, infection chains observed in October 2024 in Saudi Arabia were linked to a fraudulent OpenAI ChatGPT application.

Microsoft Windows Vulnerability Exploited to Deploy PipeMagic RansomExx Malware On August 18, 2025, cybersecurity experts revealed that threat actors exploited a recently patched vulnerability in Microsoft Windows to distribute the PipeMagic malware within RansomExx ransomware operations. This malicious activity specifically took advantage of CVE-2025-29824, a privilege escalation flaw affecting the…

Read More

Microsoft Windows Flaw Used to Launch PipeMagic RansomExx Malware

Cybersecurity researchers have revealed that threat actors are exploiting a now-patched vulnerability in Microsoft Windows to deploy the PipeMagic malware during RansomExx ransomware attacks. This exploitation hinges on CVE-2025-29824, a privilege escalation vulnerability affecting the Windows Common Log File System (CLFS), which Microsoft addressed in April 2025, according to a report from Kaspersky and BI.ZONE. First identified in 2022, PipeMagic has been utilized in RansomExx attacks targeting industrial sectors in Southeast Asia, functioning as a backdoor that allows remote access and execution of various commands on compromised systems. Past incidents have shown attackers exploiting CVE-2017-0144, a remote code execution vulnerability in Windows SMB, to breach victim networks. Notably, infection chains observed in October 2024 in Saudi Arabia were linked to a fraudulent OpenAI ChatGPT application.

URGENT: Four Actively Exploited 0-Day Vulnerabilities Found in Microsoft Exchange Server

March 3, 2021

Microsoft has issued emergency patches for four previously undisclosed security vulnerabilities in Exchange Server that are currently being exploited by a new state-sponsored threat actor from China, aimed at data theft. The Microsoft Threat Intelligence Center (MSTIC) describes these attacks as “limited and targeted,” revealing that the adversary exploited these vulnerabilities to gain access to on-premises Exchange servers, allowing them to infiltrate email accounts and install malware for prolonged access to the victim’s environment. Microsoft confidently attributes this campaign to a group known as HAFNIUM, a sophisticated state-sponsored hacker collective based in China, while also suggesting the potential involvement of other groups. In discussing HAFNIUM’s tactics, techniques, and procedures (TTPs), Microsoft highlights the group’s high level of skill and sophistication.

URGENT: Four Actively Exploited 0-Day Vulnerabilities Discovered in Microsoft Exchange On March 3, 2021, Microsoft announced emergency patches to address four critical security vulnerabilities in its Exchange Server. These vulnerabilities, which were previously undisclosed, are reportedly being exploited by a state-sponsored threat actor from China, leading to significant concerns regarding…

Read More

URGENT: Four Actively Exploited 0-Day Vulnerabilities Found in Microsoft Exchange Server

March 3, 2021

Microsoft has issued emergency patches for four previously undisclosed security vulnerabilities in Exchange Server that are currently being exploited by a new state-sponsored threat actor from China, aimed at data theft. The Microsoft Threat Intelligence Center (MSTIC) describes these attacks as “limited and targeted,” revealing that the adversary exploited these vulnerabilities to gain access to on-premises Exchange servers, allowing them to infiltrate email accounts and install malware for prolonged access to the victim’s environment. Microsoft confidently attributes this campaign to a group known as HAFNIUM, a sophisticated state-sponsored hacker collective based in China, while also suggesting the potential involvement of other groups. In discussing HAFNIUM’s tactics, techniques, and procedures (TTPs), Microsoft highlights the group’s high level of skill and sophistication.

CBI Website Breach: Pakistani Group Takes Credit

Dec 05, 2010

The Central Bureau of Investigation (CBI) has confirmed that its official website was hacked, leading to a case being filed under the Information Technology Act. An official spokesperson revealed that unauthorized access and defacement occurred during the night of December 3-4. Law enforcement is actively working with the National Informatics Centre and CBI cybersecurity experts to restore the site. Reports surfaced on Friday about the breach, which has rendered the CBI website inaccessible. Allegedly, the attack was carried out by a group identifying itself as the Pakistan Cyber Army, which claimed to have retaliated for the hacking of 40 Pakistani sites.

CBI Website Compromised: Responsibility Claimed by Pakistani Hacker Group On December 5, 2010, the Central Bureau of Investigation (CBI) confirmed that its official website had been compromised over the weekend. A spokesperson for the agency disclosed that unauthorized access and defacement occurred between the nights of December 3 and 4,…

Read More

CBI Website Breach: Pakistani Group Takes Credit

Dec 05, 2010

The Central Bureau of Investigation (CBI) has confirmed that its official website was hacked, leading to a case being filed under the Information Technology Act. An official spokesperson revealed that unauthorized access and defacement occurred during the night of December 3-4. Law enforcement is actively working with the National Informatics Centre and CBI cybersecurity experts to restore the site. Reports surfaced on Friday about the breach, which has rendered the CBI website inaccessible. Allegedly, the attack was carried out by a group identifying itself as the Pakistan Cyber Army, which claimed to have retaliated for the hacking of 40 Pakistani sites.