The Hacker News | #1 Trusted Source for Cybersecurity News — Index Page

Let’s be honest: if you're one of the first (or the first) security hires at a small or midsize business, chances are you're also the unofficial CISO, SOC, IT Help Desk, and whatever additional roles need filling. You’re not running a security department. You are THE security department. You're getting pinged about RFPs in one area, and reviewing phishing alerts in another, all while sifting through endless FP alerts across the board. The tools meant to help are often creating more work than they solve. Security teams end up choosing between letting things slip or becoming the "Department of No." Chances are you inherited your company's Google Workspace. Thankfully, Google handles the infrastructure, the uptime, and the spam filtering. But while Google takes care of a lot, it doesn’t cover everything, and it can be difficult for security teams to operationalize all of Google’s underlying capabilities without significant engineering work. It’s your job to se...

The threat actors known as Golden Chickens have been attributed to two new malware families dubbed TerraStealerV2 and TerraLogger, suggesting continued development efforts to fine-tune and diversify their arsenal. "TerraStealerV2 is designed to collect browser credentials, cryptocurrency wallet data, and browser extension information," Recorded Future Insikt Group said . "TerraLogger, by contrast, is a standalone keylogger. It uses a common low-level keyboard hook to record keystrokes and writes the logs to local files." Golden Chickens, also known as Venom Spider, is the name given to a financially motivated threat actor linked to a notorious malware family called More_eggs . It's known to be active since at least 2018, offering its warez under a malware-as-a-service (MaaS) model. Campaigns distributing More_eggs entail the use of spear-phishing emails to target hiring managers using fake resumes, allowing attackers to steal confidential data. Other campa...

Cybersecurity researchers have discovered three malicious Go modules that include obfuscated code to fetch next-stage payloads that can irrevocably overwrite a Linux system's primary disk and render it unbootable. The names of the packages are listed below - github[.]com/truthfulpharm/prototransform github[.]com/blankloggia/go-mcp github[.]com/steelpoor/tlsproxy "Despite appearing legitimate, these modules contained highly obfuscated code designed to fetch and execute remote payloads," Socket researcher Kush Pandya said . The packages are designed to check if the operating system on which they are being run is Linux, and if so retrieve a next-stage payload from a remote server using wget. The payload is a destructive shell script that overwrites the entire primary disk (" /dev/sda ") with zeroes, effectively preventing the machine from booting up. "This destructive method ensures no data recovery tool or forensic process can restore the data, as...

An Iranian state-sponsored threat group has been attributed to a long-term cyber intrusion aimed at a critical national infrastructure (CNI) entity in the Middle East that lasted nearly two years. The activity, which lasted from at least May 2023 to February 2025, entailed "extensive espionage operations and suspected network prepositioning – a tactic often used to maintain persistent access for future strategic advantage," the FortiGuard Incident Response (FGIR) team said in a report. The network security company noted that the attack exhibits tradecraft overlaps with a known Iranian nation-state threat actor called Lemon Sandstorm (formerly Rubidium), which is also tracked as Parisite, Pioneer Kitten, and UNC757. It's been assessed to be active since at least 2017, striking aerospace, oil and gas, water, and electric sectors across the United States, the Middle East, Europe, and Australia. According to industrial cybersecurity company Dragos, the adversary has lev...

The U.S. Department of Justice (DoJ) on Thursday announced charges against a 36-year-old Yemeni national for allegedly deploying the Black Kingdom ransomware against global targets, including businesses, schools, and hospitals in the United States. Rami Khaled Ahmed of Sana'a, Yemen, has been charged with one count of conspiracy, one count of intentional damage to a protected computer, and one count of threatening damage to a protected computer. Ahmed is assessed to be currently living in Yemen. "From March 2021 to June 2023, Ahmed and others infected computer networks of several U.S.-based victims, including a medical billing services company in Encino, a ski resort in Oregon, a school district in Pennsylvania, and a health clinic in Wisconsin," the DoJ said in a statement. Ahmed is accused of developing and deploying the ransomware by exploiting a vulnerability in Microsoft Exchange Server known as ProxyLogon. The ransomware worked by either encrypting data from ...