The Breach News

Hackers Target Critical Vulnerability in ‘Alone’ WordPress Theme to Take Over Websites Through Remote Plugin Installation

Jul 31, 2025
Vulnerability / Website Security

Threat actors are currently exploiting a serious security flaw in the “Alone – Charity Multipurpose Non-profit WordPress Theme,” allowing them to seize control of vulnerable websites. The vulnerability, identified as CVE-2025-5394, has a CVSS score of 9.8. Security researcher Thái An discovered and reported the issue. According to Wordfence, the flaw involves an arbitrary file upload that affects all plugin versions up to and including 7.8.3. It was patched in version 7.8.5, released on June 16, 2025. CVE-2025-5394 arises from a function called “alone_import_pack_install_plugin(),” which lacks a necessary capability check, enabling unauthenticated users to upload arbitrary plugins from remote sources through AJAX, thus executing code remotely. “This vulnerability allows an attacker without authentication to upload arbitrary files to a vulnerable site, leading to remote code execution…”

Hackers Exploit Severe Vulnerability in WordPress Theme, Compromising Numerous Sites On July 31, 2025, reports surfaced detailing a critical security vulnerability in the “Alone – Charity Multipurpose Non-profit WordPress Theme,” which has become a focal point for cybercriminals. This flaw, identified as CVE-2025-5394, has garnered an alarming CVSS score of…

Read More

Hackers Target Critical Vulnerability in ‘Alone’ WordPress Theme to Take Over Websites Through Remote Plugin Installation

Jul 31, 2025
Vulnerability / Website Security

Threat actors are currently exploiting a serious security flaw in the “Alone – Charity Multipurpose Non-profit WordPress Theme,” allowing them to seize control of vulnerable websites. The vulnerability, identified as CVE-2025-5394, has a CVSS score of 9.8. Security researcher Thái An discovered and reported the issue. According to Wordfence, the flaw involves an arbitrary file upload that affects all plugin versions up to and including 7.8.3. It was patched in version 7.8.5, released on June 16, 2025. CVE-2025-5394 arises from a function called “alone_import_pack_install_plugin(),” which lacks a necessary capability check, enabling unauthenticated users to upload arbitrary plugins from remote sources through AJAX, thus executing code remotely. “This vulnerability allows an attacker without authentication to upload arbitrary files to a vulnerable site, leading to remote code execution…”

New Golang-Based Backdoor Leverages Telegram Bot API for Stealthy C2 Operations

February 17, 2025
Threat Intelligence / Cyber Attack

Cybersecurity experts have revealed a new backdoor written in Golang that employs Telegram for command-and-control (C2) communications. Netskope Threat Labs, which analyzed the malware, suspects it may have origins in Russia. Security researcher Leandro Fróes commented, “The malware is compiled in Golang and functions as a backdoor. While it appears to be in active development, it is fully operational.” Upon execution, the backdoor verifies its location and specific file name—“C:\Windows\Temp\svchost.exe”—and if conditions aren’t met, it duplicates itself into the intended directory, launches the copied version, and then terminates its own process. A significant feature of this malware is its use of an open-source library that provides Golang bindings for the Telegram Bot API for C2 operations. This implementation includes…

New Golang-Based Backdoor Leverages Telegram Bot API for Evasive C2 Operations February 17, 2025 In a recent development within the cybersecurity landscape, researchers have uncovered a new backdoor malware written in Golang that employs the Telegram Bot API for its command-and-control (C2) operations. This malware, potentially originating from Russia, has…

Read More

New Golang-Based Backdoor Leverages Telegram Bot API for Stealthy C2 Operations

February 17, 2025
Threat Intelligence / Cyber Attack

Cybersecurity experts have revealed a new backdoor written in Golang that employs Telegram for command-and-control (C2) communications. Netskope Threat Labs, which analyzed the malware, suspects it may have origins in Russia. Security researcher Leandro Fróes commented, “The malware is compiled in Golang and functions as a backdoor. While it appears to be in active development, it is fully operational.” Upon execution, the backdoor verifies its location and specific file name—“C:\Windows\Temp\svchost.exe”—and if conditions aren’t met, it duplicates itself into the intended directory, launches the copied version, and then terminates its own process. A significant feature of this malware is its use of an open-source library that provides Golang bindings for the Telegram Bot API for C2 operations. This implementation includes…

The Kremlin’s Cunning Hacking Group Leverages Russian ISPs to Deploy Spyware

The Russian hacker group Turla, known for their advanced cyberespionage techniques, has been linked to a new spying method that demonstrates their sophisticated approach to cyber operations. This group has made headlines for utilizing unorthodox methods, such as embedding malware communications in satellite connections or commandeering other hackers’ operations to…

Read MoreThe Kremlin’s Cunning Hacking Group Leverages Russian ISPs to Deploy Spyware

HHS Data Strategy Seeks to ‘Revitalize Health Technology’

Data Privacy, Data Security, Healthcare Voluntary Initiative Advocates for Standards and Patient Empowerment: A Privacy Perspective Marianne Kolbasuk McGee (HealthInfoSec) • July 31, 2025 President Donald Trump alongside leaders from the Department of Health and Human Services (HHS) announces a new strategy aimed at enhancing health data interoperability and access.…

Read MoreHHS Data Strategy Seeks to ‘Revitalize Health Technology’

SafePay Raises Alarm Over Ingram Micro Breach, Imposes Ransom Deadline – Dark Reading

SafePay Claims Ingram Micro Breach, Sets Ransom Deadline In a recent cybersecurity incident, SafePay has publicly accused Ingram Micro of suffering a significant data breach. The company, known for its global technology distribution, appears to be under threat after SafePay set a ransom deadline, escalating the urgency of the situation.…

Read MoreSafePay Raises Alarm Over Ingram Micro Breach, Imposes Ransom Deadline – Dark Reading

Belarus-Linked Ghostwriter Utilizes Macropack-Obfuscated Excel Macros to Distribute Malware

Feb 25, 2025
Malware / Cyber Espionage

A new campaign targeting opposition activists in Belarus and Ukrainian military and government entities is using malware-laden Microsoft Excel documents to spread a new variant of PicassoLoader. This operation appears to be an extension of an ongoing effort by the Belarus-aligned threat actor known as Ghostwriter (also referred to as Moonscape, TA445, UAC-0057, and UNC1151), which has been active since 2016. Ghostwriter is believed to align with Russian security interests and promote anti-NATO narratives.

“Preparation for the campaign began in July-August 2024, with active operations starting in November-December 2024,” stated SentinelOne researcher Tom Hegel in a technical report shared with The Hacker News. “Recent findings regarding malware samples and command-and-control (C2) infrastructure suggest that the operation continues to be active.” The attack chain, as analyzed by the cybersecurity firm, is initiated via a Google Drive shared link.

Belarus-Linked Ghostwriter Exploits Obfuscated Excel Macros to Distribute Malware February 25, 2025 Malware / Cyber Espionage A newly uncovered cyber campaign has emerged, targeting opposition activists in Belarus alongside military and governmental entities in Ukraine. This operation utilizes malware-infused Microsoft Excel documents to disseminate a variant of PicassoLoader, a malicious…

Read More

Belarus-Linked Ghostwriter Utilizes Macropack-Obfuscated Excel Macros to Distribute Malware

Feb 25, 2025
Malware / Cyber Espionage

A new campaign targeting opposition activists in Belarus and Ukrainian military and government entities is using malware-laden Microsoft Excel documents to spread a new variant of PicassoLoader. This operation appears to be an extension of an ongoing effort by the Belarus-aligned threat actor known as Ghostwriter (also referred to as Moonscape, TA445, UAC-0057, and UNC1151), which has been active since 2016. Ghostwriter is believed to align with Russian security interests and promote anti-NATO narratives.

“Preparation for the campaign began in July-August 2024, with active operations starting in November-December 2024,” stated SentinelOne researcher Tom Hegel in a technical report shared with The Hacker News. “Recent findings regarding malware samples and command-and-control (C2) infrastructure suggest that the operation continues to be active.” The attack chain, as analyzed by the cybersecurity firm, is initiated via a Google Drive shared link.

Everest Ransomware Targets Mailchimp in Minor Breach Incident

The Everest ransomware group has publicly claimed responsibility for a significant breach of Mailchimp, a widely used marketing platform for email campaigns and newsletters. This incident highlights ongoing vulnerabilities in the landscape of cybersecurity, particularly for companies reliant on digital marketing services. In a recent announcement on its dark web…

Read MoreEverest Ransomware Targets Mailchimp in Minor Breach Incident

Vanished in Sixty Minutes: The Urgent Need for Law Firms to Address Data Exfiltration Threats – Morphisec

Understanding Data Exfiltration Risks: A Wake-Up Call for Law Firms In a rapidly evolving digital landscape, law firms are facing increasing threats from data exfiltration. Recently, a comprehensive analysis highlighted critical vulnerabilities within this sector, exposing them to significant cybersecurity risks. With sensitive client information at stake, the ramifications of…

Read MoreVanished in Sixty Minutes: The Urgent Need for Law Firms to Address Data Exfiltration Threats – Morphisec