Cyber Security News

Ransomware file decryptors are critical for victims reclaiming encrypted data without funding attackers, leveraging leaked keys, algorithmic flaws, or offline cracking techniques. The No More Ransom initiative backed by law enforcement, vendors, and researchers hosts 170+ free tools covering 150+ strains as of 2025, from legacy LockBit variants to new RansomHub and BlackCat evolutions. Key […]

The post 10 Best Ransomware File Decryptor Tools – 2026 appeared first on Cyber Security News.

The notorious Scattered Lapsus$ Hunters threat group has returned to active operations after a period of silence following their high-profile supply chain attack targeting Salesforce third-party integrations, including Gainsight and Salesloft. Recent activity observed across underground Telegram channels and credential-trading forums shows the collective has rebuilt its operational structure and launched an aggressive recruitment campaign […]

The post Scattered Lapsus$ Hunters Resurface with New RaaS Platform ‘ShinySp1d3r’ and Aggressive Insider Recruitment appeared first on Cyber Security News.

If you’re evaluating cybersecurity solutions in 2026, it’s easy to feel overwhelmed by the sheer number of options available. Cyberattacks are not only more frequent than ever, but also increasingly sophisticated. At the same time, countless security vendors claim to offer comprehensive protection for your business, its data, and its customers often with similar messaging […]

The post Top 5 Best Cybersecurity Companies Leading The Industry Right Now in 2026 appeared first on Cyber Security News.

Blockchain intelligence firm TRM Labs has traced over $35 million in stolen cryptocurrency to the 2022 LastPass breach, revealing a sophisticated Russian cybercriminal laundering operation that remains active into 2025. In 2022, hackers breached LastPass and stole encrypted password vaults containing the credentials of roughly 30 million users worldwide. Although the vaults were encrypted, attackers […]

The post $35M Cryptocurrency Theft Linked to LastPass Password Manager DataBreach appeared first on Cyber Security News.

WhatsApp’s multi-device encryption protocol has long leaked metadata, allowing attackers to fingerprint users’ device operating systems, aiding targeted malware delivery. Recent research highlights partial fixes by Meta, but transparency issues persist. Meta’s WhatsApp, with over 3 billion monthly active users, uses end-to-end encryption (E2EE) for message security; however, its multi-device feature reveals device information. In […]

The post WhatsApp Vulnerabilities Leaks User’s Metadata Including Device’s Operating System appeared first on Cyber Security News.

Google has announced that Gmail will discontinue support for two key features regarding third-party email accounts. Starting in January 2026, the platform will drop support for “Gmailify” and the widely utilized “Check mail from other accounts” feature via POP3 fetching. For over a decade, power users have relied on Gmail not just as an email […]

The post Gmail to Discontinue POP3 Mail Fetching for External Email Accounts appeared first on Cyber Security News.

Higham Lane School and Sixth Form has been forced to close its doors to all students and staff this week following a significant cyber-attack that has paralyzed the institution’s IT infrastructure. The attack, confirmed by school leadership over the weekend, has taken down critical digital services, including telephone lines, email servers, and the school’s central […]

The post Cyberattack on Higham Lane School Forced to Close its Doors to all Students and Staff appeared first on Cyber Security News.

Recent findings indicate that a sophisticated threat actor is actively exploiting multiple outdated FortiWeb appliances to deploy the Sliver Command and Control (C2) framework. This campaign highlights a concerning trend where adversaries leverage open-source offensive tools to maintain persistent access within compromised networks, often bypassing traditional security defenses. The attackers appear to prioritize unpatched edge […]

The post Threat Actor Exploited Multiple FortiWeb Appliances to Deploy Sliver C2 for Persistent Access appeared first on Cyber Security News.

A dangerous new malware called Kimwolf has quietly infected over 2 million devices around the world, forcing them to act as illegal proxy servers without the owners knowing. The botnet has grown at an alarming speed and is currently being used to carry out online fraud, launch powerful cyberattacks, and steal information from millions of […]

The post Kimwolf Botnet Hacked 2 Million Devices and Turned User’s Internet Connection as Proxy Node appeared first on Cyber Security News.

A critical security vulnerability has been discovered in GNU Wget2, a widely used command-line tool for downloading files from the web. `The flaw, tracked as CVE-2025-69194, allows remote attackers to overwrite arbitrary files on a victim’s system, potentially leading to data loss or complete system compromise. The vulnerability stems from improper validation of file paths […]

The post Critical GNU Wget2 Vulnerability Let Remote Attackers to Overwrite Sensitive Files appeared first on Cyber Security News.

Brightspeed, one of America’s leading fiber broadband infrastructure providers, has become the latest victim of a significant cyberattack. The threat group known as Crimson Collective has publicly claimed responsibility for breaching the company’s systems and obtaining sensitive data. Brightspeed operates across 20 states with network infrastructure capable of serving 7.3 million homes and businesses, making […]

The post Threat Group ‘Crimson Collective’ Allegedly Claim Breach of Largest Fiber Broadband Brightspeed appeared first on Cyber Security News.

A critical security advisory addressing multiple vulnerabilities discovered in the Eaton UPS Companion (EUC) software. These security flaws, if exploited, could allow attackers to execute arbitrary code on the host system, potentially giving them complete control over affected devices. The advisory, identified as ETN-VA-2025-1026, highlights two specific vulnerabilities affecting all versions of the Eaton UPS Companion […]

The post Eaton Vulnerabilities Let Attackers Execute Arbitrary Code On the Host System appeared first on Cyber Security News.

A threat actor operating under the identifier 1011 has publicly claimed to have obtained and leaked sensitive data from NordVPN’s development infrastructure on a dark web forum. The breach reportedly exposes over ten database source codes, along with critical authentication credentials that could pose significant risks to the VPN provider’s operational security. The attacker alleges […]

The post Threat Actor Allegedly Claim Leak of NordVPN Salesforce Database with Source Codes appeared first on Cyber Security News.

GHOSTCREW emerges as a game-changing open-source toolkit for red teamers and penetration testers. This AI-powered assistant leverages large language models, integrates the MCP protocol, and supports the optional RAG architecture to orchestrate security tools via natural-language prompts.​ Developed by GH05TCREW, the project has garnered over 450 stars on GitHub, signaling strong interest in the infosec […]

The post GHOSTCREW – AI-based Red Team Toolkit for Penetration Testing Invoking Metasploit, Nmap and Other Tools appeared first on Cyber Security News.

QNAP has patched multiple security vulnerabilities in its License Center application that could allow attackers to access sensitive information or disrupt services on affected NAS devices. The issues, tracked as CVE-2025-52871 and CVE-2025-53597, were disclosed on January 3, 2026. QNAP rated the flaws as Moderate severity and confirmed that the issues have been resolved in the latest releases. The vulnerabilities affect License Center 2.0.x, a component used to […]

The post Multiple Vulnerabilities in QNAP Tools Let Attackers Obtain Secret Data appeared first on Cyber Security News.

Resecurity deploys synthetic data honeypots to outsmart threat actors, turning reconnaissance into actionable intelligence. A recent operation not only trapped an Egyptian-linked hacker but also duped the ShinyHunters group into false breach claims.​ Resecurity has refined deception technologies for counterintelligence, mimicking enterprise environments to lure threat actors into controlled traps. These build on traditional honeypots, […]

The post Hackers Trapped in Resecurity’s Honeypot During Targeted Attack on Employee Network appeared first on Cyber Security News.

A dangerous cybercrime feedback loop has emerged where stolen credentials from infostealer malware enable attackers to hijack legitimate business websites and turn them into malware distribution platforms. Recent research by the Hudson Rock Threat Intelligence Team reveals this self-sustaining cycle transforms victims into unwitting accomplices. The ClickFix Attack Method Cybercriminals use a sophisticated social engineering […]

The post Infostealers Enable Attackers to Hijack Legitimate Business Infrastructure for Malware Hosting appeared first on Cyber Security News.

Finnish authorities have detained all 14 crew members of a cargo vessel suspected of deliberately damaging an undersea telecommunications cable connecting Helsinki to Estonia. The ship, named Fitburg, was sailing from St. Petersburg, Russia, to Haifa, Israel, under a St. Vincent and the Grenadines flag when the incident occurred. The crew, comprising Russian, Georgian, Kazakh, […]

The post Finland Arrests Two Cargo Ship Crew Members Over Undersea Cable Damage appeared first on Cyber Security News.

The cybersecurity landscape is witnessing a rise in sophisticated malware that leverages legitimate tools to mask malicious intent. A prime example is VVS Stealer (also styled VVS $tealer). This Python-based malware family has been actively marketed on Telegram since April 2025. This threat targets Discord users explicitly to exfiltrate sensitive credentials, tokens, and browser data. […]

The post VVS Stealer Uses PyArmor Obfuscation to Evade Static Analysis and Signature Detection appeared first on Cyber Security News.

Over 10,000 Fortinet firewalls worldwide remain vulnerable to CVE-2020-12812, a multi-factor authentication (MFA) bypass flaw disclosed over five and a half years ago. Shadowserver recently added the issue to its daily Vulnerable HTTP Report, highlighting persistent exposure amid active exploitation confirmed by Fortinet in late 2025.​ CVE-2020-12812 stems from improper authentication in FortiOS SSL VPN […]

The post 10,000+ Fortinet Firewalls Still Exposed to 5-year Old MFA Bypass Vulnerability appeared first on Cyber Security News.