Kirsten Doyle

Cybersecurity researcher Jeremiah Fowler has uncovered a publicly accessible database containing over half a million records linked to an online ticket resale service. He reported the discovery to vpnMentor. The database was neither password-protected nor encrypted and contained 520,054 records totalling approximately 200 GB. Based on file and folder names, the data appeared to belong to “Ticket to Cash,” a resale platform for event tickets. Fowler reviewed a small sample of the documents, which included concert and event tickets, ticket transfers, receipts, and user-uploaded screenshots. Some files contained personally identifiable information (PII), such as partial credit card numbers, full names,…

An enhanced version of the StealC infostealer has been found in the wild, featuring a slew of upgrades that improve its stealth, payload control, and data exfiltration capabilities.   Dubbed StealC V2, this latest variant shows how malware authors are rapidly evolving commodity stealers into sophisticated, modular tools that are able to evade modern detection techniques. Researchers from Zscaler ThreatLabz identified and analyzed multiple recent samples of StealC V2, and discoverd that it has adopted RC4 encryption, PowerShell-based execution, and a redesigned command-and-control (C2) protocol. Also, this scourge now features a modular control panel that allows bad actors to customize the…

Twenty-five years ago today, the world was introduced to one of the most infamous computer viruses in history: ILOVEYOU. Disguised as a love letter in a simple email attachment, the worm spread like wildfire across inboxes on 4 May 2000, infecting an estimated 45 million systems within days. It caused billions in damages and forced global businesses, governments, and individuals to rethink how they handled email security. ILOVEYOU marked a turning point in cybersecurity. Unlike earlier viruses that relied on floppy disks or infected executables, ILOVEYOU exploited the human element, such as curiosity, trust, and a desire for connection. It…

World Password Day, observed on the first Thursday of May, is a global reminder of just how critical strong password habits are in today’s digital world. With cyber threats continuing to evolve, this day encourages everyone, from individuals to large organizations, to take a closer look at how they protect their online identities.   To mark the occasion, several cybersecurity experts shared their insights on the current state of password security, the challenges we face, and what steps we can all take to stay safer online. Tony Ball, President, Payment & Identity, at Entrust For decades, passwords have been the weak…

Aqua Security’s Team Nautilus has discovered a critical vulnerability in six popular AWS services that could allow bad actors to gain control over cloud environments. The flaw, rooted in how AWS automatically creates default IAM roles in new regions, could be exploited without user interaction. It could endanger organizations using Glue, SageMaker, EMR, CloudFormation, Redshift, and CodeBuild. The attack vector, termed “Shadow Role”, takes advantage of AWS’s behavior of silently creating IAM roles with predefined trust policies when specific services are used in a new region. These roles are designed to allow specific AWS services to assume them on behalf…

Seventy-five zero-day vulnerabilities were actively exploited in 2024 — down from 98 in 2023, but still higher than the 63 reported in 2022. These vulnerabilities were split between consumer-facing platforms like browsers and mobile devices, and enterprise-level technologies such as security software and networking appliances. This was one of the findings of Google Threat Intelligence Group’s (GTIG’s) annual report on zero-day vulnerabilities exploited in the wild. It revealed an interesting shift in attacker priorities despite a drop in total cases. “While individual year counts have fluctuated, the average trendline indicates that the rate of zero-day exploitation continues to grow at…

A trusted Uyghur-language text editor has been weaponized to target exiled Uyghur activists, says a new investigation by Citizen Lab. In this campaign, threat actors are exploiting culturally significant software to conduct digital surveillance against the Uyghur diaspora, a community already under intense pressure from the Chinese government. This incident is the latest in a series of digital attacks against Uyghur, Tibetan, and other diaspora communities. For years, Chinese state-aligned actors have used malware, phishing, and spyware, often hidden in culturally relevant apps, to monitor, intimidate, and silence critics abroad.  Spearphishing Attack Targets World Uyghur Congress The attack began with…

An advanced persistent threat (APT) group dubbed Earth Kurma is behind a stealthy, multi-year cyber-espionage campaign targeting government and telecommunications organizations across Southeast Asia. According to Trend Micro researchers Nick Dai and Sunny Lu, the campaign has been active since at least 2020. Sophisticated Toolsets and Cloud Abuse Earth Kurma has shown a high level of operational maturity, blending advanced malware with living-off-the-land binaries and trusted infrastructure. It uses a custom suite of malware, including TESDAT, DMLOADER, SIMPOBOXSPY, and KRNRAT, which facilitate stealthy data collection, persistence, and communication with command-and-control (C&C) servers. The malicious actors leverage public cloud platforms to…

Verizon has unveiled its 2025 Data Breach Investigations Report (DBIR), which revealed a dramatic increase in cyberattacks. The report showed that third-party breaches have doubled to 30%. Also, exploitation of vulnerabilities has increased by 34%. This creates a serious threat for businesses worldwide. The latest report shows a steep rise in zero-day exploits and ransomware—bad news for the cybersecurity landscape. Human error, weak credentials, and the abuse of GenAI continues to be major vulnerabilities. Unfortunately, bad actors only grow more cunning. The report analyzed over 22,000 security incidents, including 12,195 confirmed data breaches. It discovered that credential abuse (22%) and the exploitation of vulnerabilities (20%) remain the leading initial attack vectors,…

A new Android spyware campaign is targeting Russian military personnel by hiding malicious code inside a popular mapping app, says cybersecurity firm Doctor Web. The spyware, identified as Android.Spy.1292.origin, is embedded in a modified version of the Alpine Quest mapping application. It is being distributed through unofficial app sources, including a Russian Android app catalog and a fake Telegram channel posing as the app’s developer. Alpine Quest is widely used for topographic mapping in both online and offline modes. While it’s popular among outdoor enthusiasts, it’s often used by Russian soldiers in active combat zones, too. The attackers appear to…