Urbanists.Social Admins @admins

Recent searches

Search options

Only available when logged in.

45 posts27 participants9 posts today

**Redhotcyber** @redhotcyber@mastodon.bida.im · 3m

Redhotcyber @redhotcyber@mastodon.bida.im

Stati Uniti A Caccia Di Spazzatura! I Vecchi Data Center sono preziosi dopo il Ban delle Terre rare della Cina

Link all'articolo : https://www.redhotcyber.com/post/stati-uniti-a-caccia-di-spazzatura-i-vecchi-data-center-sono-preziosi-dopo-il-ban-delle-terre-rare-della-cina/

il blog della sicurezza informatica · 5mStati Uniti A Caccia Di Spazzatura! I Vecchi Data Center sono preziosi dopo il Ban delle Terre rare della CinaLa guerra commerciale tra Stati Uniti e Cina ha raggiunto un nuovo punto di tensione, con Pechino che il 4 aprile ha imposto restrizioni all’esportazione di sette terre rare e magneti chiave. Ora è necessaria una licenza speciale per esportare questi materiali strategici, il che rallenta notevolmente le consegne. La decisione è stata una risposta […]

#redhotcyber #hacking #cti

**Hackread.com** @Hackread@mstdn.social · 1h

Hackread.com @Hackread@mstdn.social

SuperBlack & WeaXor ransomware, XWorm, Strela Stealer, Android malware, and hacked WordPress sites all linked to Russian host #Proton66, per SpiderLabs.

Read: https://hackread.com/russian-host-proton66-superblack-weaxor-ransomware/

Threat actors are exploiting bulletproof hosting service Proton66 for malicious activities, including campaigns from SuperBlack ransomware operators, Android malware distribution via hacked WordPress, targeted attacks using XWorm and Strela Stealer, and potential connections to Chang Way Technologies. Cybersecurity experts at Trustwave's SpiderLabs have discovered an increase in malicious online activities originating from a Russian "bulletproof" hosting provider known as Proton66. These services, often favoured by cybercriminals due to their relaxed policies, have been linked to a wave of attacks targeting organizations worldwide since January 8, 2025. Researchers have detailed their findings in a two-part series. The first part highlights a major increase in "mass scanning, credential brute-forcing, and exploitation attempts" coming from Proton66's network (ASN 198953). This means attackers were actively probing for weaknesses in systems and trying to guess login details on a large scale. SpiderLabs has also noticed an increase in scanning and exploiting traffic from Proton66's network from January 8, 2025, with a sharp decline in February. The attacks targeted specific network blocks, the most active being 45.135.232.0/24 and 45.140.17.0/24, while some had been inactive for a significant period, with the last reported malicious activity dating back to July and November 2021. Traffic Volume Analysis (Source: SpiderLabs) Notably, the address 193.143.1.65, was observed connected to the operators of a new ransomware strain called SuperBlack, and its operators were distributing "some of the latest critical priority exploits,” researchers noted in the blog post. The second part discusses malware campaigns linked to Proton66, including compromised WordPress websites redirecting Android users to fake Google Play Store pages likely to steal their information or install malicious apps. The domain naming conventions used suggest targets speaking English ("us-playmarket.com"), French ("playstors-france.com"), Spanish ("updatestore-spain.com"), and Greek ("playstors-gr.com"). SpiderLabs also discovered operators deploying Strela Stealer, an information-stealing tool that extracts email login credentials from targeted systems, between January and February 2025. Another campaign involved XWorm malware targeting users of Korean-speaking chat rooms. Additionally, connections to WeaXor ransomware, a modified version of Mallox that encrypts files and demands a ransom for recovery, were detected. At the time of the report, the WeaXor group was asking for "$2,000, transferred in BTC or USDT." Sample Ransom Note (Source: SpiderLabs) Interestingly, SpiderLabs' investigation reveals a potential rebranding or connection between Proton66 and Hong Kong-based company, Chang Way Technologies Co. Limited. In November 2024, security firm Intrinsec linked Proton66 and PROSPERO to bulletproof hosting services advertised on underground forums as UNDERGROUND and BEARHOST. SpiderLabs’s investigation revealed that while the Russian control panel for UNDERGROUND/BEARHOST customers remained at my.31337.ru, the my.31337.hk page was updated with a "CHANGWAY / HOSTWAY" theme. Still, technical connections between the infrastructures remained, suggesting an underlying link. Technology and financial organizations are the prime targets of this campaign. However, the SuperBlack ransomware group preferred targeting non-profit, engineering, and financial sectors. Research by Forescout linked this IP address to the Mora_001 threat actor who exploited vulnerabilities in Fortinet FortiOS devices, leading to the deployment of the SuperBlack ransomware. It is worth noting that hackers have exploited vulnerabilities in Palo Alto Networks' PAN-OS software (CVE-2025-0108), Mitel MiCollab (CVE-2024-41713), and D-Link NAS devices (CVE-2024-10914). D-Link has announced that the affected devices have reached their end-of-life, therefore, no security updates will be provided. Nevertheless, researchers strongly recommend that organizations block all the internet address ranges associated with both Proton66 and Chang Way Technologies to protect themselves from potential compromise. Trey Ford, Chief Information Security Officer at Bugcrowd, a San Francisco, Calif.-based leader in crowdsourced cybersecurity, commented on the development, stating that while IPs aren’t reliable indicators of threat actors, since changing scan sources is cheap, patterns like consistent brute-force attempts still matter. “It’s a reminder to monitor login velocity, harden exposed services, and make attacks costly for low-effort actors,” he said.

Hackread - Latest Cybersecurity, Hacking News, Tech, AI & Crypto · 1hRussian Host Proton66 Tied to SuperBlack and WeaXor RansomwareFollow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

#CyberSecurity #CyberCrime #Russia

**Redhotcyber** @redhotcyber@mastodon.bida.im · 3h

Redhotcyber @redhotcyber@mastodon.bida.im

Gravi falle in GitHub Enterprise Server: RCE e XSS colpiscono versioni recenti

Link all'articolo : https://www.redhotcyber.com/post/gravi-falle-in-github-enterprise-server-rce-e-xss-colpiscono-versioni-recenti/

il blog della sicurezza informatica · 3hGravi falle in GitHub Enterprise Server: RCE e XSS colpiscono versioni recentiScoperte vulnerabilità gravi in GitHub Enterprise Server, inclusa una RCE. Patch disponibili. Aggiorna ora per evitare compromissioni.

#redhotcyber #hacking #cti

**Redhotcyber** @redhotcyber@mastodon.bida.im · 5h

Redhotcyber @redhotcyber@mastodon.bida.im

Un Clic e sei fregato! La nuova vulnerabilità Windows viene già sfruttata

Link all'articolo : https://www.redhotcyber.com/post/un-clic-e-sei-fregato-la-nuova-vulnerabilita-windows-viene-gia-sfruttata/

il blog della sicurezza informatica · 5hUn Clic e sei fregato! La nuova vulnerabilità Windows viene già sfruttataUna nuova falla NTLM in Windows consente il furto degli hash con un clic. Già in corso campagne APT contro agenzie governative in Europa.

#redhotcyber #hacking #cti

**Redhotcyber** @redhotcyber@mastodon.bida.im · 6h

Redhotcyber @redhotcyber@mastodon.bida.im

Falsi Miti: Se non faccio pagamenti o login online, sono davvero al sicuro?

Link all'articolo : https://www.redhotcyber.com/post/falsi-miti-se-non-faccio-pagamenti-o-login-online-sono-davvero-al-sicuro/

il blog della sicurezza informatica · 6hFalsi Miti: Se non faccio pagamenti o login online, sono davvero al sicuro?Molti pensano che non inserire carte o password sia sufficiente per stare al sicuro online. Ma è proprio questa falsa sicurezza che mette a rischio la tua identità digitale.

#redhotcyber #hacking #cti

**heise Security** @heisec@social.heise.de · 7h

heise Security @heisec@social.heise.de

Angriffe auf Microsoft-NTLM-Authentifizierung beobachtet

Angreifer haben Microsoft-NTLM-Hashes abgegriffen und zur Authentifizierung missbraucht. Davor warnt etwa die CISA.

https://www.heise.de/news/Angriffe-auf-Microsoft-NTLM-Authentifizierung-beobachtet-10357572.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

heise online · 7hAngriffe auf Microsoft-NTLM-Authentifizierung beobachtetBy Dirk Knop

#Cyberangriff #Cybercrime #Exploit

**Redhotcyber** @redhotcyber@mastodon.bida.im · 7h

Redhotcyber @redhotcyber@mastodon.bida.im

HackerHood di RHC Rivela due nuovi 0day sui prodotti Zyxel

Link all'articolo : https://www.redhotcyber.com/post/hackerhood-di-rhc-rivela-due-nuovi-bug-su-zyxel-la-tua-sicurezza-e-a-rischio/

il blog della sicurezza informatica · 7hHackerHood di RHC Rivela due nuovi 0day sui prodotti ZyxelIl collettivo di hacker etici di Red Hot Cyber, Hackerhood, ha individuato un nuovo 0day sui dispositivi della Zyxel.

#redhotcyber #hacking #cti

**Redhotcyber** @redhotcyber@mastodon.bida.im · 8h

Redhotcyber @redhotcyber@mastodon.bida.im

Arriva la Biosicurezza! Il sequenziamento del DNA è nel mirino degli hacker

Link all'articolo : https://www.redhotcyber.com/post/arriva-la-biosicurezza-il-sequenziamento-del-dna-e-nel-mirino-degli-hacker/

il blog della sicurezza informatica · 8hArriva la Biosicurezza! Il sequenziamento del DNA è nel mirino degli hackerScienziati lanciano l’allarme: il sequenziamento del DNA può essere hackerato. A rischio medicina, genetica e identità personale.

#redhotcyber #hacking #cti

**STOPDISINFORMATION** @StopDisinformation@mastodon.social · 8h

STOPDISINFORMATION @StopDisinformation@mastodon.social

#Censorship under the guise of #internetregulation

@netzpolitik.org: How did your focus shift?

*Nighat Dad: We’ve seen governments in our region introduce #regulations under the guise of addressing online harms such as #disinformation, terrorism, and #cybercrime. But when we looked more closely, it became clear that these #laws were often being used to suppress dissent and curtail #freeexpression online

https://netzpolitik.org/2025/global-majority-house-how-activists-want-to-bring-global-majority-perspectives-into-eu-tech-policy/#netzpolitik-pw

netzpolitik.org · 1dGlobal Majority House: How activists want to bring Global Majority perspectives into EU tech policyA coalition of global NGOs wants to engage in discussions about EU tech regulation. We spoke with Pakistani activist Nighat Dad about the initiative and the challenges of platform regulation. She says that now more than ever, the EU must take greater global responsibility for digital rights.

**Redhotcyber** @redhotcyber@mastodon.bida.im · 22h

22h

Redhotcyber @redhotcyber@mastodon.bida.im

A lezione di IA a 6 anni: la Cina prepara i suoi bambini alla rivoluzione dell’intelligenza artificiale

Link all'articolo : https://www.redhotcyber.com/post/a-lezione-di-ia-a-6-anni-la-cina-prepara-i-suoi-bambini-alla-guerra-dellintelligenza-artificiale/

il blog della sicurezza informatica · 22hA lezione di IA a 6 anni: la Cina prepara i suoi bambini alla rivoluzione dell’intelligenza artificialeLa Cina introduce l’intelligenza artificiale nel curriculum scolastico per studenti dai 6 anni in su. Con corsi su chatbot, etica e tecnologia, punta a dominare il futuro dell’IA. L’Estonia segue l’esempio con AI Leap 2025.

#redhotcyber #hacking #cti

**Redhotcyber** @redhotcyber@mastodon.bida.im · 1d

Redhotcyber @redhotcyber@mastodon.bida.im

SEO Poisoning: Quando Google Diventa il Primo Alleato dei Cybercriminali

Link all'articolo : https://www.redhotcyber.com/post/seo-poisoning-quando-google-diventa-il-primo-alleato-dei-cybercriminali/

Gli aggressori utilizzano sempre più spesso metodi di promozione sui motori di ricerca per attirare gli #utenti verso siti dannosi. Vengono utilizzati sia il “black SEO” sia gli annunci a pagamento, il tutto per garantire che le #risorse dannose #appaiano il più in alto possibile nei #risultati di ricerca.

Questo #approccio è chiamato SEO poisoning. I #criminali mascherano contenuti dannosi da siti legittimi, sfruttando la fiducia nei marchi noti.

il blog della sicurezza informatica · 1dSEO Poisoning: Quando Google Diventa il Primo Alleato dei CybercriminaliI cybercriminali usano SEO poisoning e annunci falsi per spingere siti dannosi nei motori di ricerca. Scopri come proteggerti dagli attacchi online

#redhotcyber #hacking #cti