Security Researchers Uncover App-in-the-Middle Attack Vulnerability on iOS Recent findings from security researchers have revealed a serious vulnerability within Apple’s iOS that allows malicious applications to exploit the Custom URL Scheme feature, potentially compromising sensitive user information. This new app-in-the-middle attack enables hostile software on a user’s device to intercept…
A significant vulnerability has been exposed in one of the most widely used FTP server applications, ProFTPD, affecting over one million servers globally. The discovery, made by German security researcher Tobias Mädel, highlights a critical flaw within the mod_copy module, a feature that allows users to copy files and directories…
The Gentlemen ransomware-as-a-service (RaaS) group has been implicated in deploying the proxy malware SystemBC, marking a significant escalation in their operations. According to recent research from Check Point, this malware’s command-and-control (C2) server has led to the identification of over 1,570 victims worldwide. SystemBC is capable of establishing SOCKS5 network…
Recent cybersecurity research has unveiled a sophisticated espionage operation linked to China, with its sights set on government and defense sectors across South, East, and Southeast Asia, as well as a NATO-affiliated European nation. Trend Micro has identified this malicious activity under the interim designation SHADOW-EARTH-053. Analysts believe this group…
Security Vulnerabilities Discovered in Popular Antivirus Solutions, Risking System Integrity Cybersecurity experts have recently uncovered significant security vulnerabilities in widely-used antivirus software, potentially allowing attackers to escalate privileges and solidify malware presence on compromised systems. A report from CyberArk researcher Eran Shimony, shared with The Hacker News, highlights the critical…
Recent Security Breaches Underscore Growing Cyber Threats In an alarming series of recent cyber incidents, it has become evident that some of the most significant security breaches often unfold quietly, without immediate alert signals. These breaches usually involve subtle actions that may appear innocuous, highlighting a troubling trend in which…
Published: Aug 11, 2025
This week has highlighted the rapid pace of cyber threats, urging businesses to remain vigilant. Attackers are uncovering vulnerabilities in widely-used software and utilizing innovative tactics to bypass security measures. Even a single unpatched vulnerability can create pathways for data breaches or unauthorized system access. Time is of the essence—failure to regularly update defenses can result in severe consequences. The imperative is clear: proactive measures are essential to safeguard your business.
Here’s a summary of the most significant cybersecurity developments this week, including recent flaws in WinRAR and NVIDIA Triton, along with essential advanced attack strategies to be aware of. Let’s dive into the details.
⚡ Threat of the Week
Trend Micro Issues Warning on Actively Exploited 0-Day — Trend Micro has provided temporary mitigations to tackle serious security vulnerabilities in on-premise versions of Apex One Management Console, which are reportedly being exploited in the wild. The flaws include CVE-2025-54948 and CVE-2025-54987.
Weekly Cybersecurity Recap: BadCam Attack, WinRAR Vulnerabilities, and Notable Ransomware Incidents August 11, 2025 In a rapidly evolving landscape, cyber attackers are intensifying their efforts, prompting businesses to maintain vigilance. This week has seen a surge in discoveries of vulnerabilities in widely used software, alongside increasingly sophisticated methods to circumvent…
Published: Aug 11, 2025
This week has highlighted the rapid pace of cyber threats, urging businesses to remain vigilant. Attackers are uncovering vulnerabilities in widely-used software and utilizing innovative tactics to bypass security measures. Even a single unpatched vulnerability can create pathways for data breaches or unauthorized system access. Time is of the essence—failure to regularly update defenses can result in severe consequences. The imperative is clear: proactive measures are essential to safeguard your business.
Here’s a summary of the most significant cybersecurity developments this week, including recent flaws in WinRAR and NVIDIA Triton, along with essential advanced attack strategies to be aware of. Let’s dive into the details.
⚡ Threat of the Week
Trend Micro Issues Warning on Actively Exploited 0-Day — Trend Micro has provided temporary mitigations to tackle serious security vulnerabilities in on-premise versions of Apex One Management Console, which are reportedly being exploited in the wild. The flaws include CVE-2025-54948 and CVE-2025-54987.
Google Unveils Unpatched and Poorly Fixed Windows 0-Day Vulnerability
Dec 24, 2020
Google’s Project Zero team has disclosed details about a poorly addressed zero-day security flaw in the Windows print spooler API, potentially allowing malicious actors to execute arbitrary code. The flaw was made public after Microsoft failed to resolve it within 90 days of responsible disclosure on September 24. Initially identified as CVE-2020-0986, the vulnerability involves an elevation of privilege exploit in the GDI Print / Print Spooler API (“splwow64.exe”) reported to Microsoft by an anonymous user collaborating with Trend Micro’s Zero Day Initiative (ZDI) in late December 2019. With no patch provided for nearly six months, ZDI publicly issued a zero-day advisory on May 19, which led to exploitation in a campaign known as “Operation PowerFall” targeting an unnamed South Korean company. “splwow64.exe” is a core Windows system binary that facilitates 32-bit application compatibility.
Google Exposes Unpatched Windows Zero-Day Vulnerability On December 24, 2020, Google’s Project Zero disclosed details about a critical yet poorly patched zero-day vulnerability within the Windows print spooler API. This flaw opens the door for malicious actors to execute arbitrary code, creating significant risks for affected systems. The decision to…
Google Unveils Unpatched and Poorly Fixed Windows 0-Day Vulnerability
Dec 24, 2020
Google’s Project Zero team has disclosed details about a poorly addressed zero-day security flaw in the Windows print spooler API, potentially allowing malicious actors to execute arbitrary code. The flaw was made public after Microsoft failed to resolve it within 90 days of responsible disclosure on September 24. Initially identified as CVE-2020-0986, the vulnerability involves an elevation of privilege exploit in the GDI Print / Print Spooler API (“splwow64.exe”) reported to Microsoft by an anonymous user collaborating with Trend Micro’s Zero Day Initiative (ZDI) in late December 2019. With no patch provided for nearly six months, ZDI publicly issued a zero-day advisory on May 19, which led to exploitation in a campaign known as “Operation PowerFall” targeting an unnamed South Korean company. “splwow64.exe” is a core Windows system binary that facilitates 32-bit application compatibility.
May 10, 2013
Trend Micro experts have identified a new piece of backdoor malware from the Winnti family, primarily utilized by a Chinese cybercriminal group targeting Southeast Asian organizations in the gaming sector. This Winnti malware enables hackers to take control of users’ systems via a backdoor hidden within the legitimate Aheadlib analysis tool. Named “Bkdr_Tengo.A,” it masquerades as a genuine system DLL file known as winmm.dll. “We believe this was executed using the legitimate Aheadlib analysis tool,” stated Eduardo Altares from Trend Micro. “The file is not encrypted and is relatively straightforward to analyze. Its primary function involves stealing Microsoft Office, .PDF, and .TIFF files from USB drives connected to the system. These extracted files are stored in the $NtUninstallKB080515$ folder within Windows, alongside a log file named Usblog_DXM.log that tracks the activity.”
New Malware Uncovered Linked to Chinese Cybercriminals Targeting Southeast Asian Gaming Sector May 10, 2013 Recent findings by researchers at Trend Micro reveal a sophisticated form of malware associated with the Winnti group, a well-known Chinese cybercriminal organization. This backdoor malware primarily targets organizations within the Southeast Asian video gaming…
May 10, 2013
Trend Micro experts have identified a new piece of backdoor malware from the Winnti family, primarily utilized by a Chinese cybercriminal group targeting Southeast Asian organizations in the gaming sector. This Winnti malware enables hackers to take control of users’ systems via a backdoor hidden within the legitimate Aheadlib analysis tool. Named “Bkdr_Tengo.A,” it masquerades as a genuine system DLL file known as winmm.dll. “We believe this was executed using the legitimate Aheadlib analysis tool,” stated Eduardo Altares from Trend Micro. “The file is not encrypted and is relatively straightforward to analyze. Its primary function involves stealing Microsoft Office, .PDF, and .TIFF files from USB drives connected to the system. These extracted files are stored in the $NtUninstallKB080515$ folder within Windows, alongside a log file named Usblog_DXM.log that tracks the activity.”
