Aggregator

2024年，安天CERT捕获了多起挖矿木马的攻击活动，现将2024年典型的挖矿木马梳理形成组织/家族概览，进行分享。

思科否认指控，并透露泄露的凭证源于2022年5月发生的已披露的安全事件。

CISOs are finding themselves more involved in AI teams, often leading the cross-functional effort and AI strategy. But there aren’t many resources to guide them on what their role should look like or what they should bring to these meetings.  We’ve pulled together a framework for security leaders to help push AI teams and committees further in their AI adoption—providing them with the

Исследователи назвали факторы, влияющие на то, как мы воспринимаем новости.

A vulnerability was found in Prestashop 8.1.7. It has been classified as problematic. This affects an unknown part of the file //index.php. The manipulation of the argument link leads to cross site scripting. This vulnerability is uniquely identified as CVE-2025-1230. It is possible to initiate the attack remotely. There is no exploit available.

Google has fixed two vulnerabilities that, when chained together, could expose the email addresses of YouTube accounts, causing a massive privacy breach for those using the site anonymously. [...]

De afgelopen week stond in het teken van wisselingen van de wacht. Het commando van de vooruitgeschoven NAVO-troepenmacht in Litouwen is weer in Duitse handen. Daarnaast werd de Nederlandse Force Protection in Bagdad afgelost. Een overzicht van Defensieoperaties in de week van 5 tot en met 11 februari 2025.

На кого теперь рассчитывать в борьбе с цифровыми угрозами национального масштаба?

2021 年美国陆军与微软签署了为期十年的 219 亿美元 AR 设备协议，采购 12.1 万部基于 HoloLens 的增强现实头戴式显示设备。该系统被称为 Integrated Visual Augmented System（IVAS）。去年 10 月微软终止了 HoloLens 的其它业务，现在微软与 Palmer Luckey 的 Anduril 公司发表联合声明，将陆军版 HoloLens 头戴式显示设备的合同转交给 Anduril。这笔交易还需要美国陆军的批准。此举可能意味着微软完全退出了 HoloLens 业务。根据新的协议，微软将提供相关的云计算和 AI 基础设施，而 Anduril 负责硬件生产和软件开发。IVAS 项目面临技术挑战，早期原型在测试中让士兵感到头疼和恶心，目前的精简版收到了更好的反馈。但产品的投产取决于今年的战斗测试。美国陆军对其费用也有很大意见——单价高达 8 万美元——认为需要大幅降低。

The North Korea-linked threat actor known as Kimsuky has been observed using a new tactic that involves deceiving targets into running PowerShell as an administrator and then instructing them to paste and run malicious code provided by them. "To execute this tactic, the threat actor masquerades as a South Korean government official and over time builds rapport with a target before sending a

Microsoft Threat Intelligence has uncovered a new tactic employed by the North Korean state-sponsored hacking group Emerald Sleet, also known as Kimsuky or VELVET CHOLLIMA. The group is leveraging social engineering techniques to trick victims into running PowerShell commands as administrators, enabling them to compromise devices and exfiltrate sensitive data. Emerald Sleet’s latest approach involves […]

The post Hackers Trick You To Run PowerShell As Admin & Paste Their Code to Hack Windows appeared first on Cyber Security News.

A vulnerability was found in eaglethemes Rise Blocks Plugin up to 3.6 on WordPress and classified as problematic. Affected by this issue is some unknown functionality. The manipulation of the argument titleTag leads to cross site scripting. This vulnerability is handled as CVE-2025-0506. The attack may be launched remotely. There is no exploit available.

A vulnerability has been found in nmedia Easy Quiz Maker Plugin up to 2.0 on WordPress and classified as problematic. Affected by this vulnerability is the function wqt-question of the component Shortcode Handler. The manipulation leads to cross site scripting. This vulnerability is known as CVE-2024-13456. The attack can be launched remotely. There is no exploit available.