cybersecurity

Archived

• In Operation RoundPress, the compromise vector is a spearphishing email leveraging an XSS vulnerability to inject malicious JavaScript code into the victim’s webmail page.
• In 2023, Operation RoundPress only targeted Roundcube, but in 2024 it expanded to other webmail software including Horde, MDaemon, and Zimbra.
• For MDaemon, Sednit used a zero-day XSS vulnerability. We reported the vulnerability to the developers on November 1st, 2024 and it was patched in version 24.5.1.
• Most victims are governmental entities and defense companies in Eastern Europe, although we have observed governments in Africa, Europe, and South America being targeted as well.
• The report provides an analysis of the JavaScript payloads SpyPress.HORDE, SpyPress.MDAEMON, SpyPress.ROUNDCUBE, and SpyPress.ZIMBRA.
• These payloads are able to steal webmail credentials, and exfiltrate contacts and email messages from the victim’s mailbox. Additionally, SpyPress.MDAEMON is able to set up a bypass for two-factor authentication.

cross-posted from: https://lemmy.sdf.org/post/34853591

Archived

The world is in a cyberwar in every sense except a legal one because no side has declared war, said Mart Noorma, director of the NATO Cooperative Cyber Defense Center of Excellence (CCDCOE) in Tallinn. Russian hackers' goal is to sow chaos and steal money, he said.

[...]

The avalanche of attacks from Russia is very intense. "The bad actors think they can attack as much as they can, limited only by how well countries can defend themselves and hold the criminals accountable," he told the show.

"The West constantly feels how hacker groups supported by the Russian authorities are carrying out attacks against us. By supporting hacker groups, the state can more easily create confusion. Then the state is not directly connected. Creating chaos has been a constant for Russia — their goal is to achieve geopolitical and cognitive effects so that people in democratic countries begin to doubt their values and governments. Even influencing presidential elections is of interest to the hackers," he explained.

"Quite often, Russian hackers also have financial motives — the proceeds are divided among state agencies," Noorma explained.

[...]

Wanna chat about something non-infosec amongst those of us who frequent /c/cybersecurity? Here’s your chance! (Keep things civil & respectful please)

cross-posted from: https://lemmy.sdf.org/post/34652759

Archived

Cyber attacks were the most common form of hybrid threat faced by Australia in the last decade, but economic coercion and foreign interference are not far behind.

[...]

Analysts at the Australian Strategic Policy Institute have been tracking hybrid threats against Australia since March 2016, and between then and February 2025 have tracked 74 discrete activities targeting the country.

Given the growing state of digital connectivity across the globe, cyber security incidents and attacks make up approximately 35 per cent of all hybrid activity. Both private and public sector companies have been targeted by largely PRC-backed hackers, such as Naikon, APT40, APT27 and Aoqin Dragon, as well as critical infrastructure entities.

[...]

“The ASPI research into hybrid threats underscores a key trend observation that we have always expected would occur: nation-state aligned threat actors are prioritising cyber security as the foremost battleground in today’s modern, digital world. Whether it is cyber-espionage or targeting critical infrastructure for sabotage, this type of conflict is no longer relegated to complex stories found in television and movies,” Satnam Narang, senior staff research engineer at Tenable, told Defence Connect.

Economic coercion, foreign interference, and narrative & disinformation campaigns all make up about 20-25 per cent each targeted activity, and here again, China is highly active. China is thought to have engaged in efforts to sway debate toward far-right sources during the Voice to Parliament campaign, and its extensive Spamouflage network of fake social media accounts targeted an Australian rare earth mining company in recent years as well.

Journalists and members of the Chinese diaspora in Australia have also been targeted by Chinese influence and harassment campaigns.

China’s efforts to impact the Australian economy include tariffs and bans on Australian produce, trade restrictions, and even consumer boycotts

[...]

“Economic coercion involves actions that go beyond standard trade policy [such as tariffs], including: engaging in targeted boycotts; blocking access to essential resources; and imposing sanctions with the explicit goal of forcing political concessions.”

Military and paramilitary coercion only makes up about 15 per cent of hybrid activity, but as ASPI notes, such activity has increased in the last few years, and, again, China is the main culprit. Only recently, we have had the example of a Chinese naval flotilla performing firing drills in the Tasman Sea and aerial encounters between Chinese and Australian military aircraft in the South China Sea – all just in February 2025 alone.

[...]

Of course, while China is responsible for the bulk of hybrid activity targeting Australia, it is not alone. China is responsible for 69 per cent of such activity, with Russia the next most active nation at 11 per cent of activity, trailed closely by Iran, which makes up fully ten per cent of hybrid threat activity.

Other nations make up four per cent of activity, unidentified hackers responsible for five per cent of threat activity, and ideologically motivated violent extremism is one per cent.

[...]

cross-posted from: https://lemmy.sdf.org/post/34536054

Archived

China-Nexus Nation State Actors Exploit SAP NetWeaver (CVE-2025-31324) to Target Critical Infrastructures, according to a research.

In April 2025, China-nexus nation-state APTs (advanced persistent threat) launched high-temp exploitation campaigns against critical infrastructure networks by targeting SAP NetWeaver Visual Composer. Actors leveraged CVE-2025-31324 [...], an unauthenticated file upload vulnerability that enables remote code execution (RCE). This assessment is based on a publicly exposed directory (opendir) found on attacker-controlled infrastructure, which contained detailed event logs capturing operations across multiple compromised systems.

[...]

EclecticIQ analysts link observed SAP NetWeaver intrusions to Chinese cyber-espionage units including UNC5221 [...], UNC5174 [...], and CL-STA-0048 [...] based on threat actor tradecrafts patterns. Mandiant and Palo Alto researchers assess that these groups connect to China's Ministry of State Security (MSS) or affiliated private entities. These actors operate strategically to compromise critical infrastructures, exfiltrate sensitive data, and maintain persistent access across high-value networks worldwide.

[...]

Targets of the campaign were

• natural gas distribution networks, water and integrated waste management utilities in the United Kingdom,

• medical device manufacturing plants oil and gas exploration and production companies in the United States, and

• government ministries in Saudi Arabia that are responsible for investment strategy and financial regulation.

[...]

cross-posted from: https://lemmy.sdf.org/post/34478394

Archived

Britain’s intelligence services are seeing a “direct connection between Russian cyber attacks and physical threats to our security,” the country’s cyber chief announced on Wednesday.

Malign actors in Moscow are “waging acts of sabotage, often using criminal proxies in their plots,” warned Richard Horne, the head of the National Cyber Security Centre (NCSC) at the CYBERUK conference in Manchester.

Horne said both NCSC and the domestic security service MI5 were seeing the hacking threat from Russia manifesting “on the streets of the U.K. against our industries and our businesses, putting lives, critical services and national security at risk.”

He told the CYBERUK audience that the role of the information security community was “therefore not just about protecting systems, it’s about protecting our people, our economy, our society, from harm.”

[...]

[Among others], Russia is believed to have been behind a July 2024 blaze that also affected the DHL logistics chain in Leipzig, Germany. If that parcel bomb bound for the U.K. had detonated aboard a flight it could have caused a plane crash, German security services said.

A third incident took place in July near Warsaw, the capital of Poland. As reported by Reuters, the attempts are believed to be a “dry run” for a future plot in which Russia detonates incendiary devices in midair on transatlantic cargo flights to the United States and Canada.

The devices were reportedly disguised as massage machines from Lithuania and **contained a magnesium-based substance which could have burned so destructively that an aircraft would have crashed. ** In November, Kęstutis Budrys, the chief national security adviser to Lithuania’s President Gitanas Nausėda, blamed Russia’s military intelligence agency, known as the GRU, for the plots. Other Western security officials have agreed with this assessment.

[...]

Weekly thread for any and all career, learning and general guidance questions. Thinking of taking a training or going for a cert? Wondering how to level up your career? Wondering what NOT to do? Got other questions? This is the time and place to ask!

Wanna chat about something non-infosec amongst those of us who frequent /c/cybersecurity? Here’s your chance! (Keep things civil & respectful please)

cross-posted from: https://scribe.disroot.org/post/2697498

cross-posted from: https://scribe.disroot.org/post/2697495

Archived link

Foreign powers, ransomware gangs and AI threats are driving a surge in incidents affecting British businesses and government systems, [the British Intelligence Agency] GCHQ has warned.

Britain has suffered double the number of “nationally significant” cyberattacks in recent months compared with the year before, according to GCHQ.

Richard Horne, chief executive of the National Cyber Security Centre (NCSC), said that the GCHQ unit has managed 200 cyberattacks since September, which includes “twice as many nationally significant incidents as the same period last year”.

...

Referencing the recent attacks on Marks & Spencer, Co-op and Harrods, Horne told the CyberUK conference in Manchester that “the threat picture is diverse and dramatic” and called ransomware “a persistent threat”.

...

Rod Latham, director of cybersecurity at the Department for Science, Innovation and Technology, said: “Our statistics indicate that four in ten businesses are attacked in a year, three in ten charities — millions of cybercrimes in a year.”

...

Horne called China “the pacing threat in the cyber-realm” and “a cause for profound and profuse concern”.

...

On Russia he said that “we see a direct connection between Russian cyberattacks and physical threats to our security” and warned that amid talks on Ukraine, “it is almost certain that Russia will continue its wider cyber espionage activity … against Ukraine and supporting countries”.

...

Today we released Vulnerability-Lookup 2.9.0 with new features, enhancements, and bug fixes.

What's New

Adversarial Techniques from MITRE EMB3D

The Adversarial Techniques from MITRE EMB3D are now integrated into Vulnerability-Lookup as a new source and are correlated with existing security advisories.

This feature was contributed by Piotr Kaminski during the last Hack.lu hackathon. (#129)

Global CVE Allocation System (GCVE)

GCVE identifiers are now supported in HTML templates and URL parameters,
thanks to the GCVE Python client.
These identifiers can now be used when disclosing a new vulnerability as part of the Coordinated Vulnerability Disclosure (CVD) process, in alignment with NIS 2 requirements. (8bb3d84, 58c394a)

Trustworthy Level for Members

Members of a Vulnerability-Lookup instance now have a dynamically calculated
trustworthy level based on profile completeness and verification.
Members affiliated with FIRST.org or European CSIRTs (CNW) are automatically
trusted for operations that would otherwise require administrator approval
(e.g., creating comments).

Changes

• New API endpoint for MITRE EMB3D. (c0d6b44)
• Improved the vulnerability disclosure page. (ccfb6b1)
• Added page arguments to the vulnerability/last endpoint. (ce75a7a)
• Notification emails now include a random signoff. (#119)
• Various graphical enhancements. (0878a31)

Fixes

• Fixed editing of notifications for Organization/Product. (#124)

Changelog

📂 To see the full rundown of the changes, users can visit the changelog on GitHub: https://github.com/vulnerability-lookup/vulnerability-lookup/releases/tag/v2.9.0

Weekly thread to discuss whatever you’re working on, big or small, at work or in your free time.

cross-posted from: https://lemmy.sdf.org/post/33999334

Archived

• Under the new rules, tenders will award bonus scores to offers that deploy cybersecurity technologies manufactured in Italy, EU member states, NATO countries, or other like-minded partners.
• The legislation follows high‑profile incidents of Chinese technology infiltrating sensitive sites, ranging from surveillance cameras in courts and ministries to thermoscanners at the prime minister’s office, and the award of customs‑scanner contracts to China’s Nuctech.
• Products include: video surveillance and access‑control systems (including baggage and cargo scanners); VPN‑capable digital networking products, routers, modems (including satellite types), and switches; firewalls, intrusion detection and prevention systems; network storage and backup solutions; cloud services; drone‑control software
• Preference is extended to suppliers from the EU, NATO members, and “like‑minded” countries with collaboration agreements—namely Australia, South Korea, Japan, Israel, New Zealand, and Switzerland.
• The government retains authority to update the list of covered categories and beneficiary states, based on recommendations from public administrations and intelligence agencies, ensuring the framework evolves alongside emerging security needs.

[...]