The Breach News

Critical Vulnerability Discovered in Pulse Connect Secure VPN

May 25, 2021

Ivanti, the provider of Pulse Secure VPN appliances, has issued a security advisory regarding a critical vulnerability that could enable an authenticated remote attacker to execute arbitrary code with elevated privileges. The issue, described as a “Buffer Overflow in Windows File Resource Profiles” in version 9.X, allows a remote user with permission to access SMB shares to potentially execute arbitrary code as the root user. Notably, as of version 9.1R3, this permission is disabled by default. The vulnerability, classified as CVE-2021-22908, has a CVSS score of 8.5 out of 10 and affects Pulse Connect Secure versions 9.0Rx and 9.1Rx. According to a report from the CERT Coordination Center, the vulnerability arises from the gateway’s capacity to connect to Windows file shares using various CGI endpoints that can be exploited in the attack.

High-Severity Vulnerability Identified in Pulse Connect Secure VPN May 25, 2021 Ivanti, the organization responsible for Pulse Secure VPN appliances, has issued an urgent security advisory concerning a significant vulnerability that poses a risk to users. This flaw could potentially permit an authenticated remote attacker to execute arbitrary code with…

Read More

Critical Vulnerability Discovered in Pulse Connect Secure VPN

May 25, 2021

Ivanti, the provider of Pulse Secure VPN appliances, has issued a security advisory regarding a critical vulnerability that could enable an authenticated remote attacker to execute arbitrary code with elevated privileges. The issue, described as a “Buffer Overflow in Windows File Resource Profiles” in version 9.X, allows a remote user with permission to access SMB shares to potentially execute arbitrary code as the root user. Notably, as of version 9.1R3, this permission is disabled by default. The vulnerability, classified as CVE-2021-22908, has a CVSS score of 8.5 out of 10 and affects Pulse Connect Secure versions 9.0Rx and 9.1Rx. According to a report from the CERT Coordination Center, the vulnerability arises from the gateway’s capacity to connect to Windows file shares using various CGI endpoints that can be exploited in the attack.

Cyber Attack Targets Computers at Israeli Foreign Ministry

Oct 26, 2012

In recent days, several Israeli government offices have experienced a cyber attack, seemingly intended to introduce a “Trojan horse” into their computer systems. To mitigate the threat, Israeli police swiftly disconnected the national computer network from civilian Internet access. The Trojan horse was delivered via email attachments that had the IDF Chief of Staff Benny Gantz’s name in the subject line. Reports from Haaretz indicate that a senior government official emphasized an ongoing investigation into the police threat by cybersecurity experts. It remains unclear whether the attacks were part of a widespread cyber operation or limited to a few compromised systems. Government employees have been advised to refrain from opening suspicious emails or Facebook messages. Many identical emails were sent on Wednesday to Israeli embassies worldwide and to employees within the Foreign Ministry. Intelligence alerts regarding the situation are under review.

Cyber Attack Targets Israeli Foreign Ministry Computers On October 26, 2012, multiple Israeli government offices experienced a significant cyber attack, specifically designed to infiltrate computer systems through a Trojan horse malware. This incident raised immediate concerns regarding the integrity of sensitive governmental data and prompted swift action from Israeli authorities.…

Read More

Cyber Attack Targets Computers at Israeli Foreign Ministry

Oct 26, 2012

In recent days, several Israeli government offices have experienced a cyber attack, seemingly intended to introduce a “Trojan horse” into their computer systems. To mitigate the threat, Israeli police swiftly disconnected the national computer network from civilian Internet access. The Trojan horse was delivered via email attachments that had the IDF Chief of Staff Benny Gantz’s name in the subject line. Reports from Haaretz indicate that a senior government official emphasized an ongoing investigation into the police threat by cybersecurity experts. It remains unclear whether the attacks were part of a widespread cyber operation or limited to a few compromised systems. Government employees have been advised to refrain from opening suspicious emails or Facebook messages. Many identical emails were sent on Wednesday to Israeli embassies worldwide and to employees within the Foreign Ministry. Intelligence alerts regarding the situation are under review.

From Allies to Adversaries: The Rise and Fall of a Legendary Privacy Tool

Unraveling the Enigma of Daniel Micay: A Cybersecurity Contender Information regarding Daniel Micay is notably sparse, generating intrigue within the cybersecurity community. A cursory search uncovers a sparse X account, a minimalist LinkedIn profile, and divisive commentary across platforms like YouTube, Reddit, and HackerNews. These discussions depict him variously as…

Read MoreFrom Allies to Adversaries: The Rise and Fall of a Legendary Privacy Tool

Chinese Hackers Murky Panda, Genesis, and Glacial Panda Intensify Cloud and Telecom Espionage Efforts

August 22, 2025
Cloud Security / Vulnerability

Cybersecurity experts are alerting the public to the growing threat posed by the China-linked cyber espionage group known as Murky Panda. This group is employing trusted cloud relationships to infiltrate enterprise networks. According to a report from CrowdStrike, “The adversary has demonstrated a significant capacity to rapidly exploit N-day and zero-day vulnerabilities, often gaining initial access by targeting internet-facing devices.” Murky Panda, previously recognized as Silk Typhoon (and formerly Hafnium), gained notoriety for its exploitation of Microsoft Exchange Server vulnerabilities in 2021. Their attacks have primarily focused on government, technology, academic, legal, and professional services sectors in North America. Earlier this March, Microsoft revealed the threat actor’s evolving strategies, particularly their focus on the IT supply chain to gain entry into corporate networks.

Chinese Hackers Murky Panda, Genesis, and Glacial Panda Amplify Cloud and Telecom Espionage Efforts August 22, 2025 – In a recent analysis, cybersecurity experts have flagged a significant escalation in malicious activities orchestrated by a China-linked cyber espionage group known as Murky Panda. This group has been exploiting trusted relationships…

Read More

Chinese Hackers Murky Panda, Genesis, and Glacial Panda Intensify Cloud and Telecom Espionage Efforts

August 22, 2025
Cloud Security / Vulnerability

Cybersecurity experts are alerting the public to the growing threat posed by the China-linked cyber espionage group known as Murky Panda. This group is employing trusted cloud relationships to infiltrate enterprise networks. According to a report from CrowdStrike, “The adversary has demonstrated a significant capacity to rapidly exploit N-day and zero-day vulnerabilities, often gaining initial access by targeting internet-facing devices.” Murky Panda, previously recognized as Silk Typhoon (and formerly Hafnium), gained notoriety for its exploitation of Microsoft Exchange Server vulnerabilities in 2021. Their attacks have primarily focused on government, technology, academic, legal, and professional services sectors in North America. Earlier this March, Microsoft revealed the threat actor’s evolving strategies, particularly their focus on the IT supply chain to gain entry into corporate networks.

Urgent Security Alert: Critical RCE Flaw Discovered in VMware vCenter Server – Immediate Patching Recommended!

May 26, 2021

VMware has issued patches to fix a severe security vulnerability in vCenter Server that could allow attackers to execute arbitrary code on the server. Identified as CVE-2021-21985 (with a CVSS score of 9.8), this vulnerability arises from insufficient input validation in the Virtual SAN (vSAN) Health Check plug-in, which is enabled by default in vCenter Server. According to VMware, “An attacker with network access to port 443 could exploit this vulnerability to run commands with unrestricted privileges on the underlying operating system hosting vCenter Server.”

VMware vCenter Server is a management tool for controlling virtual machines, ESXi hosts, and other related components from a centralized interface. The flaw impacts vCenter Server versions 6.5, 6.7, and 7.0, as well as Cloud Foundation versions 3.x and 4.x. VMware has acknowledged Ricter Z from 360 Noah Lab for reporting this critical vulnerability. The patch also addresses an authentication issue…

Critical Vulnerability Discovered in VMware vCenter Server — Urgent Patching Required On May 26, 2021, VMware announced the release of critical patches designed to mitigate a significant security vulnerability in its vCenter Server. This flaw, classified as CVE-2021-21985, boasts a CVSS score of 9.8, indicating its severity. The vulnerability arises…

Read More

Urgent Security Alert: Critical RCE Flaw Discovered in VMware vCenter Server – Immediate Patching Recommended!

May 26, 2021

VMware has issued patches to fix a severe security vulnerability in vCenter Server that could allow attackers to execute arbitrary code on the server. Identified as CVE-2021-21985 (with a CVSS score of 9.8), this vulnerability arises from insufficient input validation in the Virtual SAN (vSAN) Health Check plug-in, which is enabled by default in vCenter Server. According to VMware, “An attacker with network access to port 443 could exploit this vulnerability to run commands with unrestricted privileges on the underlying operating system hosting vCenter Server.”

VMware vCenter Server is a management tool for controlling virtual machines, ESXi hosts, and other related components from a centralized interface. The flaw impacts vCenter Server versions 6.5, 6.7, and 7.0, as well as Cloud Foundation versions 3.x and 4.x. VMware has acknowledged Ricter Z from 360 Noah Lab for reporting this critical vulnerability. The patch also addresses an authentication issue…

Stuxnet Virus Breached Chevron’s IT Network

Nov 09, 2012

The sophisticated Stuxnet virus, developed jointly by the U.S. and Israel to target Iran’s nuclear enrichment facilities in Natanz, also compromised Chevron’s IT network shortly after its public emergence in 2010. Chevron identified the malware in its systems following its initial discovery, noted in a blog post in July 2010, according to Mark Koelmel, general manager of the earth-sciences department at the oil giant. While the U.S. government has never formally acknowledged the Stuxnet initiative, the virus, intended to disrupt systems produced by Siemens for managing critical infrastructure, has been detected in various countries. Reports from the Wall Street Journal suggest that Chevron’s encounter with Stuxnet resulted from the malware’s unintended dissemination.

Stuxnet Virus Breaches Chevron’s IT Network Date: November 9, 2012 In a significant cybersecurity incident, the Stuxnet virus, a highly sophisticated piece of malware developed by the United States and Israel, infiltrated Chevron’s IT network shortly after its public emergence in 2010. Initially engineered to monitor and disrupt Iran’s nuclear…

Read More

Stuxnet Virus Breached Chevron’s IT Network

Nov 09, 2012

The sophisticated Stuxnet virus, developed jointly by the U.S. and Israel to target Iran’s nuclear enrichment facilities in Natanz, also compromised Chevron’s IT network shortly after its public emergence in 2010. Chevron identified the malware in its systems following its initial discovery, noted in a blog post in July 2010, according to Mark Koelmel, general manager of the earth-sciences department at the oil giant. While the U.S. government has never formally acknowledged the Stuxnet initiative, the virus, intended to disrupt systems produced by Siemens for managing critical infrastructure, has been detected in various countries. Reports from the Wall Street Journal suggest that Chevron’s encounter with Stuxnet resulted from the malware’s unintended dissemination.

Bluesky Restores Service Following DDoS Attack Claimed by Iran-Linked 313 Team

Bluesky, an increasingly popular alternative to Twitter, has returned to normal operations following a significant disruption stemming from a multi-day outage. The issue began on April 15, 2026, around 11:40 PM PDT, when users experienced halted feed updates. By daybreak, functionality deteriorated further, with users unable to receive notifications, search…

Read MoreBluesky Restores Service Following DDoS Attack Claimed by Iran-Linked 313 Team

Linux Malware Leveraging Malicious RAR Filenames Evades Antivirus Detection

In a recent report from cybersecurity researchers, a new attack strategy has been revealed, utilizing phishing emails to spread an open-source backdoor known as VShell. According to Trellix researcher Sagar Bade, this “Linux-specific malware infection chain begins with a spam email containing a harmful RAR archive file.” The unique aspect of this attack is that the malicious payload is embedded directly in the filename, rather than hidden within the file’s content or through macros. By employing shell command injection and Base64-encoded Bash payloads, attackers transform routine file listing commands into triggers for automatic malware execution. This technique exploits a common, yet dangerous pattern in shell scripts, where poorly sanitized file names allow seemingly innocuous commands like eval or echo to execute arbitrary code. Additionally, this approach provides further advantages…

Linux Malware Exploits Malicious RAR Filenames to Bypass Antivirus Detection August 22, 2025 Recent research has unveiled a sophisticated attack vector targeting Linux systems, whereby threat actors utilize phishing emails to distribute an open-source backdoor named VShell. According to cybersecurity expert Sagar Bade from Trellix, this method represents a distinct…

Read More

Linux Malware Leveraging Malicious RAR Filenames Evades Antivirus Detection

In a recent report from cybersecurity researchers, a new attack strategy has been revealed, utilizing phishing emails to spread an open-source backdoor known as VShell. According to Trellix researcher Sagar Bade, this “Linux-specific malware infection chain begins with a spam email containing a harmful RAR archive file.” The unique aspect of this attack is that the malicious payload is embedded directly in the filename, rather than hidden within the file’s content or through macros. By employing shell command injection and Base64-encoded Bash payloads, attackers transform routine file listing commands into triggers for automatic malware execution. This technique exploits a common, yet dangerous pattern in shell scripts, where poorly sanitized file names allow seemingly innocuous commands like eval or echo to execute arbitrary code. Additionally, this approach provides further advantages…

#opIsrael: Massive Cyber Attack on Israel Amid Gaza Protests

On November 19, 2012, in response to ongoing attacks in Gaza, Anonymous hackers launched a significant cyber assault on Israeli websites. According to government sources, “government and private websites are under siege from hackers, who have mounted 44 million cyberattacks in less than a week.” Additionally, Pakistani hackers defaced major platforms such as Bing, MSN, Skype, and Live. In retaliation, Israeli hackers leaked credit card information from a Palestinian ISP website. Finance Minister Yuval Steinitz reported that while one hacking attempt succeeded on an unnamed site, it was back online within ten minutes. Israel typically faces a few hundred hacking attempts daily, with the current attacks reportedly originating from across the globe. Defense websites have been particularly targeted, with the president’s site receiving 10 million hits, the foreign ministry 7 million, and the prime minister’s page 3 million.

Hackers Launch Massive Cyber Offensive Against Israeli Websites Amid Gaza Conflict November 19, 2012 In response to ongoing military actions in Gaza, a collective of Anonymous hackers has initiated a widespread cyber operation targeting Israeli websites over the past several days. The Israeli government reported experiencing a staggering 44 million…

Read More

#opIsrael: Massive Cyber Attack on Israel Amid Gaza Protests

On November 19, 2012, in response to ongoing attacks in Gaza, Anonymous hackers launched a significant cyber assault on Israeli websites. According to government sources, “government and private websites are under siege from hackers, who have mounted 44 million cyberattacks in less than a week.” Additionally, Pakistani hackers defaced major platforms such as Bing, MSN, Skype, and Live. In retaliation, Israeli hackers leaked credit card information from a Palestinian ISP website. Finance Minister Yuval Steinitz reported that while one hacking attempt succeeded on an unnamed site, it was back online within ten minutes. Israel typically faces a few hundred hacking attempts daily, with the current attacks reportedly originating from across the globe. Defense websites have been particularly targeted, with the president’s site receiving 10 million hits, the foreign ministry 7 million, and the prime minister’s page 3 million.