Sicurezza
Cybersecurity, ransomware, privacy
- inSicurezzaDigitale.com — Cybersecurity in italiano IT
- SecureBulletin — Cybersecurity news in English EN
- Ransomfeed Daily News — Daily cybersecurity news EN
2.409 voci in archivio · mostrate 426–450 .
Ababil of Minab: il gruppo Iran-MOIS che ha distrutto 58 server GPS con un solo script Python
Un’operazione distruttiva attribuita al Ministero dell’Intelligence iraniano ha colpito organizzazioni di trasporto statunitensi e aziende in Israele, Arabia Saudita e Turchia. Il gruppo Ababil of Min…
Glassworm smantellato: CrowdStrike abbatte la botnet che prendeva di mira gli sviluppatori attraverso npm, PyPI e GitHub
Il 26 maggio 2026, CrowdStrike, Google e Shadowserver Foundation hanno eseguito un takedown coordinato di Glassworm, botnet attivo da oltre un anno che infettava sviluppatori attraverso estensioni VSC…
NightSpire Ransomware Exploits RDP and Remote Admin Tools to Hit 64 Organizations in 33 Countries
NightSpire ransomware has hit at least 64 organizations across 33 countries by exploiting Remote Desktop Protocol access and installing legitimate remote administration tools like AnyDesk and Chrome R…
Seedworm (MuddyWater) APT Abuses Signed Security Binaries in Global Espionage Campaign Across 9 Countries
Iran-linked Seedworm (MuddyWater) APT has been caught running a broad espionage campaign against at least 9 organizations across 9 countries in early 2026. The group hijacked legitimate, digitally sig…
Tycoon 2FA Phishing Kit Bypasses MFA at Scale — 62% of Microsoft 365 Phishing Attempts Linked to Single Threat Actor
The Tycoon 2FA phishing-as-a-service kit, operated by threat actor Storm-1747, is bypassing multi-factor authentication on Microsoft 365 and Google Workspace accounts at massive scale. At its peak it…
BadHost (CVE-2026-48710): Critical Authentication Bypass Threatens Thousands of AI Agent Applications
A newly disclosed critical vulnerability dubbed ‘BadHost’ (CVE-2026-48710) enables attackers to bypass authentication in FastAPI and Starlette-based AI applications through manipulated HTTP Host heade…
Nimbus Manticore e il backdoor MiniFast: l’Iran usa l’IA per colpire aviazione e oil&gas durante la guerra
Il gruppo IRGC-affiliato Nimbus Manticore ha condotto tre ondate di attacchi tra febbraio e aprile 2026, sviluppando in tempo reale il nuovo backdoor MiniFast con l’ausilio dell’intelligenza artificia…
CVE-2026-5426: zero-day in KnowledgeDeliver LMS sfruttato per distribuire BLUEBEAM e Cobalt Strike BEACON
Mandiant ha pubblicato i dettagli dell’exploitation attiva di CVE-2026-5426, zero-day nel LMS KnowledgeDeliver causato da chiavi ASP.NET machineKey hardcoded e condivise tra tutte le installazioni. L’…
Fox Tempest: Microsoft DCU Dismantles Malware-Signing-as-a-Service That Forged Trusted Certificates for Ransomware Groups
Microsoft’s Digital Crimes Unit has disrupted Fox Tempest, a criminal malware-signing-as-a-service operation that abused Microsoft’s Artifact Signing infrastructure to issue fraudulent code-signing ce…
Grafana GitHub Breach: TanStack npm Supply Chain Attack Leads to Source Code Theft and Ransom Demand
Grafana Labs has confirmed a ransomware-linked breach of its GitHub environment traced to the TanStack npm supply chain compromise. Attackers exfiltrated internal source code repositories and issued a…
Void Botnet Routes Commands Through Ethereum Smart Contracts to Evade Law Enforcement Takedowns
A new Rust-based botnet sold on cybercrime forums uses Ethereum smart contracts as its command-and-control channel, making traditional infrastructure takedowns impossible. The Void Botnet supports fou…
TeamPCP Poisons Microsoft’s Official Python DurableTask SDK — Multi-Cloud Credential Worm Hits PyPI
The TeamPCP threat group has compromised three consecutive versions of Microsoft’s official Python DurableTask SDK on PyPI, injecting a worm-like payload that steals multi-cloud credentials from AWS…
Void Dokkaebi evolve InvisibleFerret: il malware nordcoreano ora usa Cython per sfuggire agli antivirus
Void Dokkaebi (Famous Chollima), APT nordcoreano specializzato nel targeting di sviluppatori software, ha aggiornato il proprio infostealer InvisibleFerret compilandolo da Python a Cython. I file ora…
Russian Hacker Builds Persistent Gemini Jailbreak to Power Influence Campaign, Credential Theft, and Crypto Wallet Draining
A Russian-speaking threat actor tracked as “bandcampro” has been exposed using a persistently jailbroken Google Gemini CLI to power a five-year operation combining AI-generated political disinformatio…
Cloud Atlas APT Patches termsrv.dll to Enable Silent Dual RDP Sessions — Targets Government and Diplomatic Organizations
The Cloud Atlas APT group has adopted a stealthy new technique: modifying Windows termsrv.dll to enable multiple simultaneous RDP sessions, allowing attackers to maintain covert access while legitimat…
Critical 7-Zip Flaw CVE-2026-48095 (CVSS 8.8) Enables Arbitrary Code Execution via NTFS Vtable Hijack
A critical heap buffer overflow in 7-Zip 26.00 (CVE-2026-48095, CVSS 8.8) lets attackers execute arbitrary code through an NTFS vtable hijack. The attack works regardless of file extension and require…
Payload Ransomware Deploys ChaCha20 + Curve25519 ECDH to Lock Files — 50+ Victims Across Five Countries
A new ransomware operation called Payload has emerged using military-grade ChaCha20 encryption paired with Curve25519 ECDH key exchange, making file recovery without the operator key impossible. Activ…
Operazione Saffron: smantellata First VPN, il servizio criminale usato da 25 gang ransomware
Un’operazione internazionale coordinata da sette paesi ha sequestrato 33 server e chiuso First VPN, la VPN criminale attiva dal 2014 preferita da almeno 25 gruppi ransomware. Le autorità avevano acces…
Laravel-Lang compromessa: oltre 700 versioni PHP infettate da uno stealer cross-platform
Un attacco supply chain ha riscritto oltre 700 tag git nei pacchetti Laravel-Lang per distribuire uno stealer PHP cross-platform capace di esfiltrare credenziali cloud, token CI/CD, wallet crypto e se…
Megalodon Campaign Backdoors 5,500+ GitHub Repositories in Six-Hour CI/CD Blitz
The automated “Megalodon” attack campaign pushed malicious CI/CD backdoors into 5,561 GitHub repositories within 6 hours on May 18, 2026, harvesting cloud credentials and OIDC tokens. The Tiledesk npm…
Supply Chain Attack Backdoors 233 Laravel-Lang Package Versions Across 700 GitHub Repositories
Attackers exploited GitHub’s tagging system to inject credential-stealing PHP backdoors into 233 versions of Laravel-Lang packages, silently targeting developer cloud keys, SSH credentials, and CI/CD…
Hackers Exploit End-of-Life F5 BIG-IP as Enterprise Entry Point, Pivoting to Active Directory via Confluence RCE
Microsoft Defender researchers document a multi-stage intrusion where threat actors exploited an end-of-life F5 BIG-IP appliance to gain SSH access, then pivoted through an unpatched Confluence server…
CVE-2026-9256 “nginx-poolslip”: Critical NGINX Flaw Enables Unauthenticated DoS and Code Execution
A critical heap buffer overflow in the NGINX rewrite module (CVE-2026-9256, “nginx-poolslip”) allows unauthenticated remote attackers to crash NGINX workers or execute code. Proof-of-concept activity…
Megalodon: 5.561 repository GitHub compromessi in sei ore con workflow CI/CD malevoli
In sei ore il 18 maggio 2026, la campagna automatizzata Megalodon ha iniettato 5.718 commit malevoli in 5.561 repository GitHub, esfiltrandone credenziali cloud, chiavi SSH e segreti CI/CD verso un C2…
art-template npm Package Backdoored to Deliver iOS Browser Exploit Kit via Supply Chain Attack
Attackers hijacked the widely-used art-template npm library by taking over its maintenance, then injected a sophisticated iOS browser exploit kit that silently targeted Safari users on vulnerable devi…