The Breach News

9 Million PCs Compromised by ZeroAccess Botnet

In recent months, the Win32/Sirefef and Win64/Sirefef rootkit family, also known as the ZeroAccess Botnet, has significantly expanded its reach, infecting millions of computers worldwide. This botnet has updated its command and control protocols and now connects to over one million systems globally. Previously, it was noted for creating hidden partitions on hard drives and utilizing alternative data streams to conceal its presence. However, recent changes by its developers have shifted its infection tactics, moving away from kernel-mode components in the latest version. Security firms have been actively monitoring the increase in x64 version infections. SophosLabs has recently uncovered a significant change in the ZeroAccess botnet’s strategy, which now operates entirely in user-mode memory. Two distinct ZeroAccess botnets exist, each featuring both 32-bit and 64-bit versions, resulting in a total of four unique botnets. Each one operates independently, communicating through a specific hard-coded port number embedded in the bot executable.

Surge in ZeroAccess Botnet Infections: 9 Million PCs Compromised On September 19, 2012, alarming reports surfaced concerning the ZeroAccess botnet, a sophisticated rootkit family identified as Win32/Sirefef and Win64 This malware has undergone significant evolution, effectively updating its command and control protocols to infiltrate an estimated 9 million computers worldwide.…

Read More

9 Million PCs Compromised by ZeroAccess Botnet

In recent months, the Win32/Sirefef and Win64/Sirefef rootkit family, also known as the ZeroAccess Botnet, has significantly expanded its reach, infecting millions of computers worldwide. This botnet has updated its command and control protocols and now connects to over one million systems globally. Previously, it was noted for creating hidden partitions on hard drives and utilizing alternative data streams to conceal its presence. However, recent changes by its developers have shifted its infection tactics, moving away from kernel-mode components in the latest version. Security firms have been actively monitoring the increase in x64 version infections. SophosLabs has recently uncovered a significant change in the ZeroAccess botnet’s strategy, which now operates entirely in user-mode memory. Two distinct ZeroAccess botnets exist, each featuring both 32-bit and 64-bit versions, resulting in a total of four unique botnets. Each one operates independently, communicating through a specific hard-coded port number embedded in the bot executable.

FBI Alerts on FSB-Linked Hackers Targeting Unpatched Cisco Devices for Cyber Espionage

Date: Aug 20, 2025 | Cyber Espionage / Vulnerability

A state-sponsored Russian hacking group, identified as Static Tundra, is exploiting a seven-year-old vulnerability in Cisco IOS and Cisco IOS XE software to gain persistent access to targeted networks. Cisco Talos revealed that these attacks are primarily aimed at telecommunications, higher education, and manufacturing sectors across North America, Asia, Africa, and Europe. Potential victims are selected based on their “strategic interest” to Russia, with recent targets focusing on Ukraine and its allies amid the ongoing Russo-Ukrainian conflict. The exploited vulnerability, CVE-2018-0171 (CVSS score: 9.8), is a critical flaw in the Smart Install feature of Cisco software, which may allow unauthorized remote attackers to initiate denial-of-service (DoS) attacks or execute arbitrary code.

FBI Alerts to FSB-Linked Hackers Targeting Unpatched Cisco Devices for Cyber Espionage On August 20, 2025, the FBI issued a warning regarding a Russian state-sponsored cyber espionage group known as Static Tundra. This group has been identified as exploiting a significant vulnerability in Cisco IOS and Cisco IOS XE software,…

Read More

FBI Alerts on FSB-Linked Hackers Targeting Unpatched Cisco Devices for Cyber Espionage

Date: Aug 20, 2025 | Cyber Espionage / Vulnerability

A state-sponsored Russian hacking group, identified as Static Tundra, is exploiting a seven-year-old vulnerability in Cisco IOS and Cisco IOS XE software to gain persistent access to targeted networks. Cisco Talos revealed that these attacks are primarily aimed at telecommunications, higher education, and manufacturing sectors across North America, Asia, Africa, and Europe. Potential victims are selected based on their “strategic interest” to Russia, with recent targets focusing on Ukraine and its allies amid the ongoing Russo-Ukrainian conflict. The exploited vulnerability, CVE-2018-0171 (CVSS score: 9.8), is a critical flaw in the Smart Install feature of Cisco software, which may allow unauthorized remote attackers to initiate denial-of-service (DoS) attacks or execute arbitrary code.

Critical Security Flaws Discovered in Netop Remote Learning Software

On March 22, 2021, cybersecurity researchers revealed significant vulnerabilities in the remote student monitoring tool, Netop Vision Pro. These weaknesses could potentially allow attackers to execute arbitrary code and gain control over Windows computers. The McAfee Labs Advanced Threat Research team warned that these vulnerabilities enable privilege escalation and could facilitate full access to students’ devices within the same network. The identified issues, labeled as CVE-2021-27192, CVE-2021-27193, CVE-2021-27194, and CVE-2021-27195, were reported to Netop on December 11, 2020. The Denmark-based company addressed these vulnerabilities in an update (version 9.7.2) released on February 25. According to Netop, this maintenance release resolved several security concerns, including local privilege escalation and transmitting sensitive data in plain text.

Vulnerabilities Discovered in Netop Remote Learning Software: A Cybersecurity Concern On March 22, 2021, cybersecurity researchers revealed multiple significant vulnerabilities in Netop Vision Pro, a widely used remote monitoring software for student oversight. These vulnerabilities could potentially allow malicious attackers to execute arbitrary code and gain control over Windows computers…

Read More

Critical Security Flaws Discovered in Netop Remote Learning Software

On March 22, 2021, cybersecurity researchers revealed significant vulnerabilities in the remote student monitoring tool, Netop Vision Pro. These weaknesses could potentially allow attackers to execute arbitrary code and gain control over Windows computers. The McAfee Labs Advanced Threat Research team warned that these vulnerabilities enable privilege escalation and could facilitate full access to students’ devices within the same network. The identified issues, labeled as CVE-2021-27192, CVE-2021-27193, CVE-2021-27194, and CVE-2021-27195, were reported to Netop on December 11, 2020. The Denmark-based company addressed these vulnerabilities in an update (version 9.7.2) released on February 25. According to Netop, this maintenance release resolved several security concerns, including local privilege escalation and transmitting sensitive data in plain text.

🔍 Webinar: Uncover and Manage Hidden AI Agents in Your Enterprise Before Hackers Do

📅 Aug 20, 2025
Category: Artificial Intelligence / Enterprise Security

Do you know how many AI agents are currently operating within your organization? If you’re uncertain, you’re not alone—and that’s a significant concern. Every day, AI agents are being deployed across various industries, often initiated by business units eager for quick results, rather than just by IT. This creates a scenario where agents operate unnoticed—without proper identification, ownership, or activity logs. Essentially, they remain invisible.

👉 Register now for “Shadow Agents and Silent Threats: Securing AI’s New Identity Frontier” to learn how to proactively address this escalating issue.

The Hidden Dangers of Shadow AI Agents

Shadow agents aren’t merely benign assistants. If compromised, they can navigate through systems effortlessly, accessing sensitive data or elevating privileges at machine speed. Unlike humans, they are relentless, working around the clock without hesitation.

The reality is that most security programs weren’t designed to handle this challenge. They focus on managing people, not autonomous software agents. As the use of AI continues to rise, these circumstances pose a significant threat.

Webinar Announcement: Identifying and Managing Shadow AI Agents in Your Organization Before Threat Actors Do Date: August 20, 2025 Sector: Artificial Intelligence / Enterprise Security In today’s fast-paced digital landscape, the presence of artificial intelligence (AI) agents within organizations raises critical security concerns. Many business leaders are uncertain about how…

Read More

🔍 Webinar: Uncover and Manage Hidden AI Agents in Your Enterprise Before Hackers Do

📅 Aug 20, 2025
Category: Artificial Intelligence / Enterprise Security

Do you know how many AI agents are currently operating within your organization? If you’re uncertain, you’re not alone—and that’s a significant concern. Every day, AI agents are being deployed across various industries, often initiated by business units eager for quick results, rather than just by IT. This creates a scenario where agents operate unnoticed—without proper identification, ownership, or activity logs. Essentially, they remain invisible.

👉 Register now for “Shadow Agents and Silent Threats: Securing AI’s New Identity Frontier” to learn how to proactively address this escalating issue.

The Hidden Dangers of Shadow AI Agents

Shadow agents aren’t merely benign assistants. If compromised, they can navigate through systems effortlessly, accessing sensitive data or elevating privileges at machine speed. Unlike humans, they are relentless, working around the clock without hesitation.

The reality is that most security programs weren’t designed to handle this challenge. They focus on managing people, not autonomous software agents. As the use of AI continues to rise, these circumstances pose a significant threat.

Critical Remote Code Execution Vulnerability Found in SolarWinds Orion Platform

On March 26, 2021, SolarWinds, a provider of IT infrastructure management solutions, announced a new update for its Orion network monitoring tool, addressing four security vulnerabilities. Among these, two critical flaws could be exploited by an authenticated attacker for remote code execution (RCE).

The most concerning issue involves a JSON deserialization vulnerability, allowing authenticated users to run arbitrary code through the “test alert actions” feature in the Orion Web Console, which simulates network events like unresponsive servers to trigger alerts during setup. This flaw has been classified as critical in severity.

The second vulnerability poses a high risk as it enables an attacker to execute RCE in the Orion Job Scheduler, although the attacker must first possess the credentials of an unprivileged local account on the Orion Server to exploit it. SolarWinds provided limited technical details in its advisory.

Critical Remote Code Execution Vulnerability Discovered in SolarWinds Orion Platform On March 25, 2021, SolarWinds, a provider of IT infrastructure management solutions, released an important update for its Orion networking monitoring tool, addressing several security vulnerabilities. Among the fixes are two significant issues that could be exploited by authenticated attackers…

Read More

Critical Remote Code Execution Vulnerability Found in SolarWinds Orion Platform

On March 26, 2021, SolarWinds, a provider of IT infrastructure management solutions, announced a new update for its Orion network monitoring tool, addressing four security vulnerabilities. Among these, two critical flaws could be exploited by an authenticated attacker for remote code execution (RCE).

The most concerning issue involves a JSON deserialization vulnerability, allowing authenticated users to run arbitrary code through the “test alert actions” feature in the Orion Web Console, which simulates network events like unresponsive servers to trigger alerts during setup. This flaw has been classified as critical in severity.

The second vulnerability poses a high risk as it enables an attacker to execute RCE in the Orion Job Scheduler, although the attacker must first possess the credentials of an unprivileged local account on the Orion Server to exploit it. SolarWinds provided limited technical details in its advisory.

Cyber Attacks Target Six Major U.S. Banks

Published: Oct 1, 2012

Recent reports indicate that several of the largest financial institutions in the United States, including Wells Fargo, JPMorgan Chase, Bank of America, Citigroup, and U.S. Bancorp, were subjected to a series of cyber attacks last week. A group claiming to have Middle Eastern affiliations executed these attacks, resulting in internet outages and disruptions to online banking services.

The banks experienced denial-of-service attacks, where hackers inundate a website with excessive traffic, causing it to become overwhelmed and shut down. Although these attacks can be disruptive, they are not technically advanced and do not compromise the security of the banks’ computer networks, funds, or customer accounts.

The group, identifying itself as “Mrt. Izz ad-Din al-Qassam Cyber Fighters,” specifically targeted Wells Fargo and announced plans to attack U.S. Bancorp and PNC Financial Services Group next. They stated that their actions were a response to an anti-Islam video that ridicules the Prophet Muhammad and vowed to persist in their assaults on American financial institutions.

Cyber Attacks Target Major U.S. Banks October 1, 2012 Recent reports indicate that several of America’s leading financial institutions, including Wells Fargo, JPMorgan Chase, Bank of America, Citigroup, and U.S. Bancorp, experienced a wave of cyber attacks last week. The assaults were attributed to a group claiming connections to the…

Read More

Cyber Attacks Target Six Major U.S. Banks

Published: Oct 1, 2012

Recent reports indicate that several of the largest financial institutions in the United States, including Wells Fargo, JPMorgan Chase, Bank of America, Citigroup, and U.S. Bancorp, were subjected to a series of cyber attacks last week. A group claiming to have Middle Eastern affiliations executed these attacks, resulting in internet outages and disruptions to online banking services.

The banks experienced denial-of-service attacks, where hackers inundate a website with excessive traffic, causing it to become overwhelmed and shut down. Although these attacks can be disruptive, they are not technically advanced and do not compromise the security of the banks’ computer networks, funds, or customer accounts.

The group, identifying itself as “Mrt. Izz ad-Din al-Qassam Cyber Fighters,” specifically targeted Wells Fargo and announced plans to attack U.S. Bancorp and PNC Financial Services Group next. They stated that their actions were a response to an anti-Islam video that ridicules the Prophet Muhammad and vowed to persist in their assaults on American financial institutions.

Discord Investigators Achieve Unauthorized Access to Anthropic’s Mythos

As the discourse around the implications of advanced AI models on cybersecurity continues, Mozilla announced that it utilized early access to Anthropic’s Mythos Preview to identify and address 271 vulnerabilities in its latest Firefox 150 browser release. Concurrently, researchers have uncovered a group of North Korean hackers who have adeptly…

Read MoreDiscord Investigators Achieve Unauthorized Access to Anthropic’s Mythos

DOM-Based Clickjacking Vulnerability Threatens Popular Password Managers, Exposing Users to Credential and Data Theft

AUGUST 20, 2025
Vulnerability / Browser Security

Recent findings reveal that widely used password manager browser extensions are vulnerable to DOM-based clickjacking attacks, which can compromise users’ account credentials, two-factor authentication (2FA) codes, and credit card information under specific conditions. Independent security researcher Marek Tóth highlighted this risk during his presentation at DEF CON 33 earlier this month. “With just a single click on an attacker-controlled site, users’ sensitive data—including credit card details, personal information, and login credentials (including TOTP)—can be stolen,” Tóth explained. This new technique is versatile and could potentially target other extension types as well. Clickjacking, also known as UI redressing, involves manipulating users into executing seemingly benign actions on a website, while the real intent is to hijack their information.

DOM-Based Extension Clickjacking Poses Risks to Leading Password Managers On August 20, 2025, new findings emerged highlighting a significant security vulnerability affecting popular password management extensions for web browsers. These vulnerabilities, known as DOM-based extension clickjacking, could potentially facilitate the theft of sensitive user information, including account credentials, two-factor authentication…

Read More

DOM-Based Clickjacking Vulnerability Threatens Popular Password Managers, Exposing Users to Credential and Data Theft

AUGUST 20, 2025
Vulnerability / Browser Security

Recent findings reveal that widely used password manager browser extensions are vulnerable to DOM-based clickjacking attacks, which can compromise users’ account credentials, two-factor authentication (2FA) codes, and credit card information under specific conditions. Independent security researcher Marek Tóth highlighted this risk during his presentation at DEF CON 33 earlier this month. “With just a single click on an attacker-controlled site, users’ sensitive data—including credit card details, personal information, and login credentials (including TOTP)—can be stolen,” Tóth explained. This new technique is versatile and could potentially target other extension types as well. Clickjacking, also known as UI redressing, involves manipulating users into executing seemingly benign actions on a website, while the real intent is to hijack their information.