The Breach News

The Importance of Security Culture in Reducing Cyber Risk

In an era where organizations have invested two decades in enhancing their security architectures, a stark reality has emerged: advanced tools and technologies alone cannot sufficiently mitigate cyber risks. As technology has evolved, so too have the tactics of cyber attackers, who are increasingly targeting human behavior rather than solely infrastructure vulnerabilities. Recent data shows that the initial breach vector is often not a technical exploit but rather the exploitation of human vulnerabilities.

According to Verizon’s Data Breach Investigations Report, human factors have been the leading cause of breaches for five consecutive years. The most recent report indicates that almost 60% of all breaches in 2024 involved a human element. However, it is essential to clarify a prevalent misconception: the notion that “people are the weakest link” wrongly places the blame solely on employees for breaches.

The Importance of Security Culture in Reducing Cyber Risk In recent years, organizations have honed their security architectures, yet a crucial reality persists: advanced tools and technologies alone cannot sufficiently mitigate cyber risk. As cybersecurity solutions evolve, malicious actors have adapted their strategies, increasingly targeting human weaknesses rather than simply…

Read More

The Importance of Security Culture in Reducing Cyber Risk

In an era where organizations have invested two decades in enhancing their security architectures, a stark reality has emerged: advanced tools and technologies alone cannot sufficiently mitigate cyber risks. As technology has evolved, so too have the tactics of cyber attackers, who are increasingly targeting human behavior rather than solely infrastructure vulnerabilities. Recent data shows that the initial breach vector is often not a technical exploit but rather the exploitation of human vulnerabilities.

According to Verizon’s Data Breach Investigations Report, human factors have been the leading cause of breaches for five consecutive years. The most recent report indicates that almost 60% of all breaches in 2024 involved a human element. However, it is essential to clarify a prevalent misconception: the notion that “people are the weakest link” wrongly places the blame solely on employees for breaches.

Urgent: Critical RCE Vulnerability Discovered in F5 Big-IP Platform—Immediate Patching Required!

On March 11, 2021, F5 Networks issued an advisory highlighting four severe vulnerabilities across various products that could lead to denial of service (DoS) attacks and unauthenticated remote code execution on affected networks. The advisory addresses a total of seven related flaws (CVE-2021-22986 through CVE-2021-22992), including two identified by Felix Wilhelm of Google Project Zero in December 2020. The four critical vulnerabilities impact BIG-IP versions 11.6, 12.x, and newer, with a notable pre-auth remote code execution issue (CVE-2021-22986) also affecting BIG-IQ versions 6.x and 7.x. F5 has stated that it is not currently aware of any public exploitation of these vulnerabilities. If successfully exploited, these flaws could lead to complete system compromise, enabling remote code execution and potential buffer overflow, resulting in DoS conditions. Customers are strongly urged to apply updates immediately.

Critical Vulnerability Discovered in F5 Big-IP Platform: Immediate Patching Recommended On March 11, 2021, F5 Networks, a prominent player in application security, issued an urgent advisory regarding four significant vulnerabilities affecting its Big-IP platform. These security flaws, which span several F5 products, pose severe risks, including the potential for denial-of-service…

Read More

Urgent: Critical RCE Vulnerability Discovered in F5 Big-IP Platform—Immediate Patching Required!

On March 11, 2021, F5 Networks issued an advisory highlighting four severe vulnerabilities across various products that could lead to denial of service (DoS) attacks and unauthenticated remote code execution on affected networks. The advisory addresses a total of seven related flaws (CVE-2021-22986 through CVE-2021-22992), including two identified by Felix Wilhelm of Google Project Zero in December 2020. The four critical vulnerabilities impact BIG-IP versions 11.6, 12.x, and newer, with a notable pre-auth remote code execution issue (CVE-2021-22986) also affecting BIG-IQ versions 6.x and 7.x. F5 has stated that it is not currently aware of any public exploitation of these vulnerabilities. If successfully exploited, these flaws could lead to complete system compromise, enabling remote code execution and potential buffer overflow, resulting in DoS conditions. Customers are strongly urged to apply updates immediately.

Future Group’s E-Commerce Site Hacked, Halting Online Sales

December 22, 2010

Future Group’s ambitions to enhance online sales have hit a significant setback. Its main e-commerce platform, FutureBazaar, has experienced a cyber attack and has been unavailable for the past two days. CEO Rajiv Prakash referred to the incident as a “denial of service attack,” stating, “The website has been down for the last couple of days and is currently inaccessible to consumers.” The company is actively addressing the situation internally and taking legal steps against the perpetrators. “We have filed a complaint with the Cyber Crime Branch in Mumbai. We are working diligently to restore the site, and it should be operational soon,” Prakash reassured. To mitigate financial losses, the company is maintaining its phone commerce service, enabling customers to make purchases through that channel. While Prakash did not disclose the estimated daily losses from the outage, the portal represents a key growth area for the group. Future Group aims to achieve at least 10% of…

Future Group’s E-Commerce Platform Compromised, Hindering Online Operations December 22, 2010 Future Group, an influential player in the retail sector, is facing a significant setback in its efforts to enhance online sales. The company’s flagship e-commerce portal, FutureBazaar, has reportedly been compromised by a cyber-attack, rendering it non-operational for the…

Read More

Future Group’s E-Commerce Site Hacked, Halting Online Sales

December 22, 2010

Future Group’s ambitions to enhance online sales have hit a significant setback. Its main e-commerce platform, FutureBazaar, has experienced a cyber attack and has been unavailable for the past two days. CEO Rajiv Prakash referred to the incident as a “denial of service attack,” stating, “The website has been down for the last couple of days and is currently inaccessible to consumers.” The company is actively addressing the situation internally and taking legal steps against the perpetrators. “We have filed a complaint with the Cyber Crime Branch in Mumbai. We are working diligently to restore the site, and it should be operational soon,” Prakash reassured. To mitigate financial losses, the company is maintaining its phone commerce service, enabling customers to make purchases through that channel. While Prakash did not disclose the estimated daily losses from the outage, the portal represents a key growth area for the group. Future Group aims to achieve at least 10% of…

Public Exploit Combines Two Critical SAP Vulnerabilities, Leaving Unpatched Systems Open to Remote Code Execution

Date: Aug 19, 2025
Category: Vulnerability / Cyber Espionage

A new exploit has emerged that leverages two critical, now-patched vulnerabilities in SAP NetWeaver, putting organizations at significant risk of system compromise and data theft. This exploit chains CVE-2025-31324 and CVE-2025-42999 to bypass authentication and enable remote code execution, according to SAP security firm Onapsis.

  • CVE-2025-31324 (CVSS score: 10.0) – Lacks authorization checks in SAP NetWeaver’s Visual Composer development server
  • CVE-2025-42999 (CVSS score: 9.1) – Vulnerability due to insecure deserialization in the same server

These vulnerabilities were patched by SAP in April and May 2025, but not before they were exploited as zero-days by threat actors as early as March. Multiple ransomware and data extortion groups, including Qilin, BianLian, and RansomExx, have been seen exploiting these flaws, along with several espionage groups linked to China targeting critical infrastructures.

Public Exploit for Chained SAP Vulnerabilities Poses Risk of Remote Code Execution August 19, 2025 A concerning new exploit has come to light that leverages two critical security vulnerabilities in SAP NetWeaver, introducing significant risks for organizations that have yet to apply patches. This exploit combines CVE-2025-31324 and CVE-2025-42999, enabling…

Read More

Public Exploit Combines Two Critical SAP Vulnerabilities, Leaving Unpatched Systems Open to Remote Code Execution

Date: Aug 19, 2025
Category: Vulnerability / Cyber Espionage

A new exploit has emerged that leverages two critical, now-patched vulnerabilities in SAP NetWeaver, putting organizations at significant risk of system compromise and data theft. This exploit chains CVE-2025-31324 and CVE-2025-42999 to bypass authentication and enable remote code execution, according to SAP security firm Onapsis.

  • CVE-2025-31324 (CVSS score: 10.0) – Lacks authorization checks in SAP NetWeaver’s Visual Composer development server
  • CVE-2025-42999 (CVSS score: 9.1) – Vulnerability due to insecure deserialization in the same server

These vulnerabilities were patched by SAP in April and May 2025, but not before they were exploited as zero-days by threat actors as early as March. Multiple ransomware and data extortion groups, including Qilin, BianLian, and RansomExx, have been seen exploiting these flaws, along with several espionage groups linked to China targeting critical infrastructures.

Released ProxyLogon Exploit PoC: A Potential Catalyst for Increased Cyber Attacks

March 11, 2021

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) issued a joint advisory on Wednesday, highlighting ongoing exploitation of vulnerabilities in Microsoft Exchange on-premises products by both nation-state actors and cybercriminals. “CISA and FBI assess that adversaries could exploit these vulnerabilities to compromise networks, steal sensitive information, encrypt data for ransom, or conduct destructive attacks,” the agencies stated. They also noted that compromised networks might be sold on the dark web. Recent attacks have mainly targeted local governments, academic institutions, NGOs, and businesses across various sectors such as agriculture, biotechnology, aerospace, defense, legal services, power utilities, and pharmaceuticals—consistent with previous activities linked to Chinese cyber threats. Tens of thousands of entities, including the Eur…

ProxyLogon Exploit Now Public, Heightening Cyber Threats Date: March 11, 2021 The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) have issued an urgent advisory concerning the exploitation of serious vulnerabilities within Microsoft Exchange on-premises products. This advisory comes in the wake of confirmed…

Read More

Released ProxyLogon Exploit PoC: A Potential Catalyst for Increased Cyber Attacks

March 11, 2021

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) issued a joint advisory on Wednesday, highlighting ongoing exploitation of vulnerabilities in Microsoft Exchange on-premises products by both nation-state actors and cybercriminals. “CISA and FBI assess that adversaries could exploit these vulnerabilities to compromise networks, steal sensitive information, encrypt data for ransom, or conduct destructive attacks,” the agencies stated. They also noted that compromised networks might be sold on the dark web. Recent attacks have mainly targeted local governments, academic institutions, NGOs, and businesses across various sectors such as agriculture, biotechnology, aerospace, defense, legal services, power utilities, and pharmaceuticals—consistent with previous activities linked to Chinese cyber threats. Tens of thousands of entities, including the Eur…

Bank of America Website Targeted in Cyber Attack by Islamic Hackers

Sept 19, 2012

The Bank of America’s website faced intermittent outages on Tuesday due to cyber attacks claimed to be in retaliation for “Innocence of Muslims,” a controversial film that has sparked violent protests across the Middle East. The group “Cyber Fighters of Izz ad-Din Al Qassam” announced its intent to target the Bank of America and the New York Stock Exchange as part of a broader campaign against what they term “American-Zionist Capitalists.” Following recent successful attacks on YouTube servers by various Muslim groups, there has been a surge in threats of similar actions. The hackers stated, “As long as the supporters of the sacrilegious film attempt to penalize its cast and crew, this conflict will continue, and the cyber realm will remain treacherous for all enemies of Islam.” Reports of the attacks have emerged from across the nation.

Bank of America Website Faces Cyber Attacks Amid Rising Tensions September 19, 2012 On Tuesday, the website of Bank of America experienced significant disruptions due to targeted cyber attacks, which have been linked to escalating geopolitical tensions. These attacks stem from a response to “Innocence of Muslims,” a controversial film…

Read More

Bank of America Website Targeted in Cyber Attack by Islamic Hackers

Sept 19, 2012

The Bank of America’s website faced intermittent outages on Tuesday due to cyber attacks claimed to be in retaliation for “Innocence of Muslims,” a controversial film that has sparked violent protests across the Middle East. The group “Cyber Fighters of Izz ad-Din Al Qassam” announced its intent to target the Bank of America and the New York Stock Exchange as part of a broader campaign against what they term “American-Zionist Capitalists.” Following recent successful attacks on YouTube servers by various Muslim groups, there has been a surge in threats of similar actions. The hackers stated, “As long as the supporters of the sacrilegious film attempt to penalize its cast and crew, this conflict will continue, and the cyber realm will remain treacherous for all enemies of Islam.” Reports of the attacks have emerged from across the nation.

New GodRAT Trojan Targets Trading Firms Using Steganography and Gh0st RAT Techniques

August 19, 2025
Malware / Cyber Attack

Financial institutions, particularly trading and brokerage firms, are currently facing a new threat from a remote access trojan known as GodRAT. According to Kaspersky researcher Saurabh Sharma, this malware is spread through malicious .SCR (screen saver) files disguised as financial documents sent via Skype Messenger. Active as recently as August 12, 2025, the attacks utilize steganography to hide shellcode within image files, enabling the download of the malware from a command-and-control (C2) server. Since September 9, 2024, these screen saver artifacts have targeted regions including Hong Kong, the United Arab Emirates, Lebanon, Malaysia, and Jordan. Based on Gh0st RAT, GodRAT employs a plugin-based architecture to enhance its capabilities for gathering sensitive information and delivering additional payloads like AsyncRAT.

Emerging GodRAT Trojan Targets Trading Firms with Steganographic Techniques On August 19, 2025, cybersecurity firm Kaspersky disclosed a significant new threat affecting trading and brokerage firms: a remote access Trojan (RAT) dubbed GodRAT. This new malware leverages a technique known as steganography to conceal its malicious code within image files,…

Read More

New GodRAT Trojan Targets Trading Firms Using Steganography and Gh0st RAT Techniques

August 19, 2025
Malware / Cyber Attack

Financial institutions, particularly trading and brokerage firms, are currently facing a new threat from a remote access trojan known as GodRAT. According to Kaspersky researcher Saurabh Sharma, this malware is spread through malicious .SCR (screen saver) files disguised as financial documents sent via Skype Messenger. Active as recently as August 12, 2025, the attacks utilize steganography to hide shellcode within image files, enabling the download of the malware from a command-and-control (C2) server. Since September 9, 2024, these screen saver artifacts have targeted regions including Hong Kong, the United Arab Emirates, Lebanon, Malaysia, and Jordan. Based on Gh0st RAT, GodRAT employs a plugin-based architecture to enhance its capabilities for gathering sensitive information and delivering additional payloads like AsyncRAT.

Vulnerabilities in Two Major WordPress Plugins Impact Over 7 Million Sites

On March 18, 2021, researchers revealed security flaws in several WordPress plugins, which, if exploited, could enable attackers to execute arbitrary code and potentially take control of affected websites. The vulnerabilities were found in Elementor, a widely-used website builder plugin installed on more than seven million sites, and WP Super Cache, a popular tool for serving cached pages on WordPress. According to Wordfence, which identified the weaknesses in Elementor, the issue involves a series of stored cross-site scripting (XSS) vulnerabilities (CVSS score: 6.4). This occurs when malicious scripts are injected directly into a vulnerable web application. Specifically, the lack of server-side validation for HTML tags allows an attacker to inject executable JavaScript into posts or pages through crafted requests. “Since posts created by contributors are usually reviewed by editors or administrators before publication, any JavaScript added to one of the…

Vulnerabilities in Two Major WordPress Plugins Expose Over 7 Million Sites Researchers have revealed critical vulnerabilities in several WordPress plugins that pose high security risks, potentially enabling attackers to execute arbitrary code and seize control of affected websites. The identified flaws are present in Elementor, a widely used website builder…

Read More

Vulnerabilities in Two Major WordPress Plugins Impact Over 7 Million Sites

On March 18, 2021, researchers revealed security flaws in several WordPress plugins, which, if exploited, could enable attackers to execute arbitrary code and potentially take control of affected websites. The vulnerabilities were found in Elementor, a widely-used website builder plugin installed on more than seven million sites, and WP Super Cache, a popular tool for serving cached pages on WordPress. According to Wordfence, which identified the weaknesses in Elementor, the issue involves a series of stored cross-site scripting (XSS) vulnerabilities (CVSS score: 6.4). This occurs when malicious scripts are injected directly into a vulnerable web application. Specifically, the lack of server-side validation for HTML tags allows an attacker to inject executable JavaScript into posts or pages through crafted requests. “Since posts created by contributors are usually reviewed by editors or administrators before publication, any JavaScript added to one of the…

Bharatiya Janata Party Website Hacked and Defaced by Anonymous Collective

September 19, 2012

The official website of the Bharatiya Janata Party (BJP.org) was hacked and defaced last night by members of the Anonymous Indian group. The hackers posted a series of messages and images expressing their disapproval of various government actions, including the approval of 51% FDI in multi-brand retail, the increase in diesel prices, corruption scandals, the cartoon controversy, and the Kudankulam Power Project.

They also called for public participation in the #OccupyIndiaground protest, scheduled for September 23, 2012 (this Sunday) at several key locations across India, including India Gate in Delhi, Freedom Park in Bangalore, Marine Beach in Chennai, Park Street Crossing in Kolkata, MG Road in Pune, and Subhash Park in Kochi.

The affected domains include:

Additionally, the group shared a YouTube video featuring a message from Anonymous, highlighting their concerns regarding the declining state of free speech in India and the government’s measures to restrict social media.

Bharatiya Janata Party Website Compromised by Anonymous Hackers On the evening of September 19, 2012, the official website of the Bharatiya Janata Party, BJP.org, fell victim to a cyberattack attributed to a group associated with Anonymous. This incident involved a significant defacement of the site, during which hackers displayed a…

Read More

Bharatiya Janata Party Website Hacked and Defaced by Anonymous Collective

September 19, 2012

The official website of the Bharatiya Janata Party (BJP.org) was hacked and defaced last night by members of the Anonymous Indian group. The hackers posted a series of messages and images expressing their disapproval of various government actions, including the approval of 51% FDI in multi-brand retail, the increase in diesel prices, corruption scandals, the cartoon controversy, and the Kudankulam Power Project.

They also called for public participation in the #OccupyIndiaground protest, scheduled for September 23, 2012 (this Sunday) at several key locations across India, including India Gate in Delhi, Freedom Park in Bangalore, Marine Beach in Chennai, Park Street Crossing in Kolkata, MG Road in Pune, and Subhash Park in Kochi.

The affected domains include:

Additionally, the group shared a YouTube video featuring a message from Anonymous, highlighting their concerns regarding the declining state of free speech in India and the government’s measures to restrict social media.