Sicurezza
Cybersecurity, ransomware, privacy
- inSicurezzaDigitale.com — Cybersecurity in italiano IT
- SecureBulletin — Cybersecurity news in English EN
- Ransomfeed Daily News — Daily cybersecurity news EN
2.824 voci in archivio · mostrate 1.051–1.075 .
BLACKWATER Ransomware Group Debuts with 3.3 TB Heist from Turkey’s Largest Hospital Network
A newly emerged ransomware operation called BLACKWATER has claimed its first major victim: Medical Park Hospitals Group, Turkey’s largest private healthcare network with 36 hospitals. The attackers al…
Fortinet FortiClientEMS Under Active Attack: Critical CVE-2026-35616 (CVSS 9.1) Added to CISA KEV Catalog
A critical improper access control vulnerability in Fortinet FortiClientEMS (CVE-2026-35616, CVSS 9.1) is being actively exploited following the publication of a public proof-of-concept. CISA has adde…
PRISMEX: la suite di cyberspionaggio di APT28 che prende di mira Ucraina e alleati NATO con steganografia e cloud C2
APT28 ha lanciato una nuova campagna di cyberspionaggio contro Ucraina e alleati NATO con PRISMEX, una suite di malware inedita che combina steganografia ‘Bit Plane Round Robin’, COM hijacking e abuso…
SmokedHam e UNC2465: il backdoor dei ransomware operator che si nasconde nei tool IT più usati dagli amministratori
Orange Cyberdefense ha documentato una campagna di malvertising attiva nel 2026 in cui UNC2465, gruppo affiliato a DarkSide, LockBit e Qilin, distribuisce il backdoor SmokedHam tramite falsi installer…
Critical SAP SQL Injection CVE-2026-27681 (CVSS 9.9) Exposes Financial Data in Business Planning and Warehouse Systems
SAP’s April 2026 Patch Day addresses CVE-2026-27681, a near-perfect CVSS 9.9 SQL injection flaw in SAP Business Planning and Consolidation (BPC) and Business Warehouse (BW). A low-privileged user can…
ShinyHunters Breaches Rockstar Games via Supply Chain Attack: 80 Million Records Ransomed, Data Leaked After Deadline
ShinyHunters compromised Rockstar Games through a supply chain attack on third-party analytics provider Anodot, stealing 80 million records from Snowflake data warehouses. After a $200,000 ransom dead…
PayoutsKing: il ransomware che si nasconde in una macchina virtuale per eludere gli antivirus
Un nuovo gruppo criminale sfrutta QEMU per eseguire una macchina virtuale nascosta nei sistemi compromessi, rendendo il ransomware PayoutsKing praticamente invisibile agli strumenti di sicurezza endpo…
CyberAv3ngers: Iran-Linked IRGC Hackers Target Rockwell PLCs Across U.S. Critical Infrastructure
A joint CISA advisory warns that Iran-linked CyberAv3ngers (IRGC-CEC) are actively exploiting internet-exposed Rockwell Automation PLCs across U.S. water, energy, and government sectors. Over 5,200 de…
Three Windows Defender Zero-Days Exploited in the Wild: BlueHammer Patched, RedSun and UnDefend Still Unpatched
A security researcher dropped three Windows Defender zero-day exploits in 13 days — BlueHammer (CVE-2026-33825), RedSun, and UnDefend. All three are now confirmed active in live attacks, with two stil…
Operation PowerOFF: 21 paesi coordinati smantellano 53 piattaforme DDoS-for-hire e identificano 75.000 cyberattaccanti
Europol ha coordinato la più vasta operazione globale contro le piattaforme DDoS-for-hire: 53 domini sequestrati, 4 arresti, 25 mandati di perquisizione e 75.000 utenti allertati in 21 paesi. L’operaz…
Booking.com Data Breach Exposes Customer Reservation Details, Raising Phishing Risk for Travellers
Booking.com has notified customers of a data breach that exposed names, addresses, email addresses, phone numbers, and full reservation details. While payment data was not compromised, security expert…
APT28 Deploys New PRISMEX Malware Suite Against Ukraine and NATO in Sophisticated Espionage Campaign
Russia’s APT28 (Fancy Bear) has launched a new campaign deploying the previously undocumented PRISMEX malware framework, which uses steganography, COM hijacking, and legitimate cloud services for C2…
Operation Masquerade: l’FBI smantella la rete di router compromessi dall’intelligence militare russa APT28 per il furto di credenziali Microsoft 365
Il Dipartimento di Giustizia USA ha neutralizzato l’infrastruttura di 18.000 router compromessi dall’Unità GRU 26165 (APT28/Forest Blizzard) in 120 paesi. L’operazione, denominata Masquerade, ha inter…
CISA Adds Apache ActiveMQ CVE-2026-34197 to KEV Catalog as Active Exploitation Surges
CISA has added CVE-2026-34197, a high-severity (CVSS 8.8) deserialization flaw in Apache ActiveMQ Classic, to its Known Exploited Vulnerabilities catalog after active exploitation was detected within…
Microsoft April 2026 Patch Tuesday: Actively Exploited SharePoint Zero-Day Among 167 Fixes
Microsoft’s April 2026 Patch Tuesday patches 167 vulnerabilities including an actively exploited SharePoint Server zero-day (CVE-2026-32201) and a publicly disclosed Windows Defender race condition (C…
Chime Faces Class Action Lawsuit Over April 2026 Data Breach: Complaint Claims It ‘Could Have Been Prevented’
A class action lawsuit filed against neobank Chime Financial alleges the company ‘lost control’ of customer payment and personal data in an April 2026 breach. Plaintiffs claim Chime failed to implemen…
Laptop farm DPRK smantellata: 9 anni a Kejia Wang, infiltrati in oltre 100 aziende USA e rubato codice ITAR a un defense contractor
Il DOJ ha inflitto le prime pene a doppia cifra di anni a facilitator statunitensi dello schema ‘IT worker’ nordcoreano. Kejia e Zhenxing Wang, 9 e 7 anni e 8 mesi, hanno gestito dal New Jersey decine…
Kong RAT: la nuova campagna di SEO poisoning con dropper NativeAOT .NET 10 che prende di mira gli sviluppatori cinesi
eSentire TRU ha documentato Kong RAT, un impianto modulare distribuito via installer contraffatti di FinalShell, Xshell, QuickQ e Clash. La catena a sei stadi sfrutta un dropper NativeAOT in .NET 10 —…
CERT-UA Exposes APT Malware Campaign Targeting Eastern European Governments and Municipal Hospitals
Ukraine’s CERT-UA has disclosed a sophisticated infostealer campaign targeting government bodies and municipal healthcare institutions across Eastern Europe. The malware harvests credentials from Chro…
CVE-2026-39987: Marimo RCE Zero-Day Exploited Within 10 Hours of Disclosure — 662 Attacks Recorded
A critical unauthenticated RCE vulnerability in the Marimo Python notebook framework (CVE-2026-39987) was actively exploited just 10 hours after public disclosure. Sysdig recorded 662 exploit events o…
BLACKWATER Ransomware Debuts with Devastating Strike on Major Turkish Hospital Network, Claims 3.3 TB Stolen
A newly emerged ransomware group called BLACKWATER has claimed its first major victim: Medical Park Hospitals Group in Turkey, with 36 hospitals affected and 3.3 terabytes of sensitive patient and ope…
Qilin e Warlock BYOVD: come il ransomware disabilita 300+ soluzioni EDR utilizzando driver vulnerabili
Qilin e Warlock utilizzano la tecnica BYOVD per disabilitare oltre 300 soluzioni EDR con driver vulnerabili del kernel, rappresentando una escalation significativa nella sofisticazione del ransomware…
APT28 PRISMEX: la suite malware di spionaggio dell’esercito russo colpisce l’Ucraina e gli alleati NATO
L’APT28 lancia una sofisticata campagna PRISMEX combinando steganografia avanzata e abuso di servizi cloud legittimi per colpire l’Ucraina e i partner NATO con capacità di spionaggio e sabotaggio.
MuddyWater-Linked APT Campaign Scanned 12,000+ Systems Before Striking Middle East Critical Infrastructure
Iran-linked threat group MuddyWater is behind a sophisticated espionage campaign that scanned over 12,000 systems in the Middle East before stealing passport records and payroll data from an Egyptian…
Fake Ledger Live App on Apple’s Mac App Store Steals $9.5 Million in Crypto from 50+ Victims
A counterfeit Ledger Live app remained live on Apple’s Mac App Store for two weeks, tricking users into entering their cryptocurrency wallet seed phrases. At least 50 victims lost a combined $9.5 mill…