AsyncRAT rides ScreenConnect: what’s going on? Researchers detail a campaign abusing ConnectWise ScreenConnect to deploy AsyncRAT and pinch credentials and crypto. Attackers either hijack a ScreenConnect session or lure victims with trojanised installers in phishing emails. Once in, they run a layered VBScript + PowerShell loader that fetches two payloads (“logs.ldk” and “logs.ldr”), sets up […]
FBI warning: crime rings are nicking your Salesforce data The FBI has issued a flash alert about two financially motivated threat clusters, UNC6395 and UNC6040, actively raiding Salesforce environments for data theft and extortion. UNC6395 piggy-backed on the Salesloft Drift incident by abusing compromised OAuth tokens, a breach Salesloft links to an earlier GitHub account […]
HybridPetya: the ransomware that slips past Secure Boot Security researchers (ESET) have analysed a new ransomware strain dubbed HybridPetya, which echoes Petya/NotPetya but adds a modern twist: it can bypass UEFI Secure Boot using a now-patched flaw (CVE-2024-7344) in a UEFI component. Samples appeared on VirusTotal in February 2025. HybridPetya works via an installer + […]
Automation is redefining pentesting (and yes, it’s about time) While penetration testing remains essential, the delivery of results hasn’t kept pace. Many teams still receive long, static PDFs and then manually copy findings into tools like Jira or ServiceNow—adding delays and eroding value. It promotes automated pentest delivery: streaming findings in real time into the […]
Citrix rushes fixes for three NetScaler bugs — one’s already being exploited Citrix has released patches for three security flaws in NetScaler ADC and NetScaler Gateway. One of them—CVE-2025-7775 (CVSS 9.2)—is already being actively exploited. The others are CVE-2025-7776 (CVSS 8.8) and CVE-2025-8424 (CVSS 8.7). • 7775/7776 are memory overflow bugs that can lead to […]
Salt Typhoon: edge devices in the firing line “Salt Typhoon,” a China-linked APT, has been exploiting vulnerabilities in edge network devices (notably from Cisco, Ivanti and Palo Alto Networks) to break into organisations worldwide—around 600 victims across 80 countries, including the UK. Initial access involves known CVEs (e.g., Cisco IOS XE and Smart Install flaws, […]
Google: Salesloft Drift breach bigger than expected Google and Mandiant warned that the recent Salesloft Drift OAuth breach is broader than first thought, affecting all Drift integrations, not just Salesforce. Attackers stole OAuth tokens and, in some cases, accessed Salesforce data and even a small number of Google Workspace mailboxes tied specifically to Drift’s email […]
Attackers turn Velociraptor into a C2 taxi • What happened: Researchers spotted attackers installing the open-source forensic tool Velociraptor and then using it to fetch and run Visual Studio Code in “tunnel” mode—turning a developer editor into a handy route back to an attacker-controlled C2 server. • How they got in: Windows msiexec pulled an […]
Browsers: your biggest risk you’re staring at all day This piece argues the humble web browser has become a prime battleground: the author claims over 80% of security incidents now start in browser-based apps and spotlights Scattered Spider (aka UNC3944 / Octo Tempest / Muddled Libra) for targeting identities and data inside Chrome, Edge, Firefox […]
