⚫RansomwareHIGH
Third US Security Expert Admits Helping Ransomware Gang
A third cybersecurity expert admitted helping ransomware gangs, signaling a dangerous trend. Attackers now recruit certified insiders for access instead of relying on exploits.
All Stories
The full HackWire archive — 3,892 stories, newest first.
🟡VulnerabilitiesHIGH
Surge in Bomgar RMM Exploitation Demonstrates Supply Chain Risk
Bomgar RMM is facing a surge in exploitation, exposing critical supply chain risk. When MSP platforms are compromised, attackers gain access to thousands of downstream customer networks, amplifying impact across entire sectors.
🟡VulnerabilitiesHIGH
Exploits Turn Windows Defender into Attacker Tool
Researchers discovered Windows Defender vulnerabilities allowing attackers to execute system-level code, disable monitoring, and maintain persistence by exploiting the tool's deep OS integration. This converts initial access into a durable, privileged compromise—turning the primary security tool int
🟣MalwareMEDIUM
New Lotus data wiper used against Venezuelan energy, utility firms
Lotus, a newly discovered data-wiping malware, targeted Venezuelan energy infrastructure in purely destructive attacks aligned with geopolitical tensions—not traditional ransomware seeking financial gain.
🟡VulnerabilitiesHIGH
Siemens TPM 2.0
Siemens disclosed CVE-2025-2884 in TPM 2.0 firmware affecting 23+ industrial control systems. Local attackers can exploit improper input validation to leak cryptographic data or crash systems.
🟡VulnerabilitiesHIGH
Siemens RUGGEDCOM CROSSBOW Secure Access Manager Primary
CVE-2026-27668 in Siemens RUGGEDCOM allows authenticated users to escalate privileges and gain unrestricted admin access (CVSS 8.8). The network-accessible flaw affects critical infrastructure and manufacturing facilities worldwide by breaking role-based access controls.
🟡VulnerabilitiesHIGH
Silex Technology SD-330AC and AMC Manager
Silex disclosed 13 critical vulnerabilities (CVSS 9.8) in device servers and management software, enabling unauthenticated remote code execution through buffer overflows and missing authentication. Multiple attack paths compound the risk.
🟡VulnerabilitiesMEDIUM
Scattered Spider Member Tylerb Pleads Guilty
Tyler Buchanan, a Scottish hacker (aka "Tylerb"), pleaded guilty for orchestrating Scattered Spider's phishing attacks on tech firms like Twilio and LastPass, stealing millions in cryptocurrency from US investors. His guilty plea marks a major law enforcement victory against one of the past five yea
⚫RansomwareHIGH
SystemBC C2 Server Reveals 1,570+ Victims in The Gentlemen Ransomware Operation
The Gentlemen RaaS controls 1,570+ systems via proxy malware for persistent access before encryption. The discovery shows how modern ransomware gangs build multi-layered infrastructure.
⚫RansomwareHIGH
Ransomware Negotiator Pleads Guilty to Aiding BlackCat Attacks in 2023
A Florida-based negotiator pleaded guilty to negotiating ransoms for BlackCat, one of the world's most prolific ransomware-as-a-service operations. The case reveals how criminal enterprises rely on specialized operatives—not just coders—to extract maximum payments from victims through psychological
🟡VulnerabilitiesHIGH
22 BRIDGE:BREAK Flaws Expose Thousands of Lantronix and Silex Serial-to-IP Converters
22 vulnerabilities in Lantronix/Silex converters expose ~20,000 industrial devices. These legacy connectivity bridges are security blind spots—rarely patched despite controlling critical systems.
🟡VulnerabilitiesMEDIUM
Stopping Fraud at Each Stage of the Customer Journey Without Adding Friction
IPQS demonstrates that intelligent multi-signal fraud detection can balance security and user experience. Organizations can deploy sophisticated anti-fraud controls without the high friction that blocks legitimate transactions, using strategic signal deployment throughout the customer journey.
🔴BreachesHIGH
Data Breaches at Healthcare Organizations in Illinois and Texas Affect 600,000
600,000 patient records were breached in Illinois and Texas healthcare organizations, exposing personal, medical, and financial data. The incidents highlight persistent security vulnerabilities in the healthcare sector amid rising cybercriminal threats.
🟡VulnerabilitiesMEDIUM
Progress Patches Multiple Vulnerabilities in MOVEit WAF, LoadMaster
Progress Software released patches for critical vulnerabilities in MOVEit WAF and LoadMaster, widely used in enterprises. The flaws enable authentication bypass, code execution, and privilege escalation (CVSS 5.3–8.8).
🟡VulnerabilitiesHIGH
Organizations Warned of Exploited Cisco, Kentico, Zimbra Vulnerabilities
Threat actors actively exploit critical vulnerabilities in Cisco, Kentico, and Zimbra platforms. Public proof-of-concept code drives coordinated attacks on government, financial institutions, and critical infrastructure globally.
🟡VulnerabilitiesMEDIUM
Unsecured Perforce Servers Expose Sensitive Data From Major Orgs
Unsecured Perforce servers expose source code, credentials, and intellectual property to attackers across tech, gaming, and aerospace firms. This critical vulnerability is preventable with proper authentication controls.
🟡VulnerabilitiesMEDIUM
Dozens of Malicious Crypto Apps Land in Apple App Store
Dozens of malicious crypto apps breached the Apple App Store, using credential harvesting and fake exchange interfaces to defraud users. The incident reveals persistent vulnerabilities in Apple's security review process despite the platform's curated marketplace reputation.
🟡VulnerabilitiesMEDIUM
Serial-to-IP Devices Hide Thousands of Old & New Bugs
Serial-to-IP converters enable network access to legacy equipment but harbor thousands of unpatched vulnerabilities—including default credentials, buffer overflows, and authentication bypasses. Most critical infrastructure organizations lack proper inventory of these devices, creating a shadow attac
🔵PolicyMEDIUM
Chinese APT Targets Indian Banks, Korean Policy Circles
Chinese APT groups are escalating attacks on Indian banks and South Korean policymakers via phishing and malware, aiming to gather intelligence on economic systems and regional security. The campaigns demonstrate state-level coordination and reflect broader strategic competition in South Asia and Ea
🟡VulnerabilitiesCRITICAL
CISA flags new SD-WAN flaw as actively exploited in attacks
CISA added a critical SD-WAN vulnerability to its exploited flaws catalog after threat actors began weaponizing it in real-world attacks. The flaw enables unauthorized network access, lateral movement into core infrastructure, data exfiltration, and persistent compromises of branch office and cloud-
🟡VulnerabilitiesMEDIUM
5 Places where Mature SOCs Keep MTTR Fast and Others Waste Time
Mature SOCs respond to threats faster by centralizing threat context, not through superior tools or staff. This structural advantage cuts MTTR significantly, reducing incident damage, compliance risk, and team burnout.
🟡VulnerabilitiesMEDIUM
UK probes Telegram, teen chat sites over CSAM sharing concerns
Ofcom is investigating Telegram for failing to prevent child sexual abuse material distribution. The inquiry reflects growing pressure on platforms to balance privacy with child safety obligations.
🟡VulnerabilitiesHIGH
Google Patches Antigravity IDE Flaw Enabling Prompt Injection Code Execution
Google patched a critical prompt injection vulnerability in Antigravity IDE that allowed arbitrary code execution through insufficient input sanitization. The flaw exploited file-creation capabilities, potentially compromising developer systems.
🟣MalwareMEDIUM
NGate Campaign Targets Brazil, Trojanizes HandyPay to Steal NFC Data and PINs
NGate Android malware resurfaces in Brazil via a trojanized HandyPay app, using AI-generated code to intercept NFC payment data and steal PINs. The campaign represents a major escalation in mobile payment threats targeting Latin America, with attackers embedding malicious code into legitimate apps.