A U.S. court ordered Israeli spyware maker NSO Group to halt operations targeting WhatsApp and reduced damages in Meta’s lawsuit. The decision reinforces accountability for private surveillance firms accused of breaching digital privacy.
Cybercriminals have found a way to turn Velociraptor an open-source DFIR and endpoint monitoring tool into a stealthy persistence mechanism, deploying hidden backdoors on compromised systems. Security researchers warn that trusted forensic tools are increasingly being repurposed for post-exploitation control.
NVIDIA’s Jensen Huang says there are no active discussions to sell Blackwell chips to China. Because U.S. export controls bind shipments and Beijing restricts foreign accelerators in state-funded data centers, near-term access looks unlikely. This analysis explains what that means for procurement, security, and model roadmaps and how to design for heterogeneous accelerators without betting your budget on rumors.
The number of data-leak sites hit an all-time high in 2025, marking a major escalation in the ransomware ecosystem. Threat groups expanded their leak operations across the dark web, with some running multiple extortion portals at once. Analysts say this surge reflects a fundamental shift in how ransomware crews monetize stolen data.
The PyPI “SoopSocks” package claims to be a SOCKS5 proxy solution but conceals backdoor capabilities, enabling attackers to control compromised systems remotely.
Within four weeks, AWS, Azure and Cloudflare all suffered major outages triggered by internal configuration and metadata failures rather than attacks. This article unpacks the Cloudflare–Azure–AWS outage pattern, examines how cloud centralisation amplifies these incidents and outlines realistic resilience moves for IT, SRE and security teams.
Herodotus is a new Android banking trojan that fakes human typing with randomized delays. Because naive timing checks fail, defenders should harden policy, watch overlays and Accessibility events, and tune fraud models to catch the session—not just the cadence.
UK investigators seized 61,000 Bitcoin linked to Zhimin Qian’s China-based Ponzi fraud. A London court handed her 11 years and 8 months, while civil recovery fights over billions continue.
A China-linked crew still breaks in through legacy CVEs Log4j, Struts, Confluence, GoAhead then hides behind scheduled tasks and msbuild.exe to run memory-resident payloads. They probe domain controllers with DCSync, and they target misconfigured IIS by abusing ASP.NET machine keys to deploy TOLLBOOTH with SEO cloaking. Reduce risk by patching edge services, restricting LOLBAS on servers, rotating machine keys, and alerting on replication from non-DC hosts.
The recently disclosed flaw in LANSCOPE Endpoint Manager (CVE-2025-61932) enables unauthenticated attackers to send malicious packets, execute arbitrary code and compromise systems. Organisations must patch affected versions, apply network controls and monitor for unusual traffic to avoid full network takeover.