Kirsten Doyle

ReliaQuest has uncovered a serious vulnerability in SAP NetWeaver, a popular software platform used by many businesses around the world. In April 2025, the company investigated several customer incidents involving SAP NetWeaver, a technology integration platform. Bad actors were able to upload unauthorized files and run malicious programs. ReliaQuest found that attackers had placed “JSP webshells” into public directories, similar to what happens with a remote file inclusion (RFI) vulnerability. Notably, many of the affected systems were already up-to-date with the latest SAP service packs and patches. This, said ReliaQuest, posed the questions, if attackers were exploiting an old vulnerability…

In 2024 alone, the FBI’s Internet Crime Complaint Center (IC3) received a staggering 859,532 complaints, with reported losses surging to an all-time high of $16.6 billion—a 33% increase over 2023. Of those complaints, more than 256,000 involved actual financial losses, with an average loss of $19,372 per incident. These were some of the findings from the IC3’s 2024 Internet Crime Report—the agency’s 25th report that tracks cyber-enabled crime across the US. Its message is clear: online crime is more pervasive, more damaging, and more sophisticated than ever before. “The criminals Americans face today may look different than in years past,…

CISA has published five advisories alerting of critical vulnerabilities in Industrial Control Systems (ICS) manufactured by Siemens, Schneider Electric, and ABB.   The advisories detail high-severity flaws that could enable malicious actors to access sensitive systems, disrupt industrial operations, or execute malicious code Firstly, CISA warns that multiple SQL injection vulnerabilities have been discovered in Siemens’ TeleControl Server Basic SQL, with the potential to grant attackers unauthorized database access and code execution capabilities. Affected internal methods include: Each vulnerability could allow bad actors to bypass authorization mechanisms and manipulate backend databases, threatening the integrity of industrial systems. Another advisory details a…

Marks & Spencer (M&S) has confirmed it is managing a cyber incident that has caused minor disruptions to its store operations in the last few days. Despite the security breach, the British retailer reassured customers that all stores remain open and that its website and mobile app are operating as normal. In a statement released today, M&S said: “As soon as we became aware of the incident, it was necessary to make some minor, temporary changes to our store operations to protect customers and the business and we are sorry for any inconvenience experienced. Importantly, our stores remain open and…

A ransomware group called Sarcoma has claimed responsibility for a cyberattack on Manchester Credit Union (MCU) in the UK. The credit union reported technical issues with its payment system earlier this month but described the incident as a “failed ransomware attack,” saying no customer data was compromised. Although MCU said no ransom demand was received, Sarcoma has listed the firm on its leak site and threatened to auction stolen data if payment isn’t made. The bad actors wiped some servers, causing two days of downtime for 21 employees, complicating forensic investigations. Sarcoma, active since October 2024, has been linked to…

At a time when cyber threats are escalating at unprecedented rates, a new warning has emerged for businesses and government entities: networks may be exposing organizations to more danger than they realize. Lawrence Pingree, Vice President at Dispersive and former security lead at Gartner, has published “Your Network Is Showing — Time to Go Stealth,” an in-depth look at how cyberattacks have evolved beyond the perimeter. Pingree points out that malicious actors are no longer simply trying to bypass defenses — they’re now executing coordinated campaigns that target the defenses themselves. Firewalls, VPNs, and control planes, once the cornerstone of…

Researchers at Trustwave have uncovered a surge in malicious online activity traced to IP addresses belonging to a Russian bulletproof hosting provider dubbed Proton66. Since 8 January this year, Trustwave’s SpiderLabs researchers have seen a steep increase in mass scanning, credential brute-forcing, and exploitation attempts targeting organizations around the world. The detailed findings, including technical indicators of compromise and deeper forensic analysis, can be found here (Part 1) and here (Part 2). Both look at Proton66’s role in hosting malicious infrastructure used for launching widespread cyberattacks. According to Trustwave, Proton66 is linked to another Russian autonomous system named PROSPERO. This…

Researchers from HUMAN Security’s Satori Threat Intelligence and Research Team have uncovered a sophisticated ad fraud operation, dubbed “Scallywag,” which exploits WordPress extensions to profit from digital piracy.  The scheme targeted users wanting free access to premium content—a longstanding challenge in the digital world. Scallywag operators developed and distributed WordPress plugins promising access to pirated material — like movies, TV shows, and sporting events. Once installed on websites, these plugins covertly manipulated users’ browsing activities by inserting ad-heavy intermediary pages and redirecting traffic without user consent to generate illicit advertising revenue. According to the findings, Scallywag leveraged deceptive tactics categorized…

A team of researchers from Ruhr University Bochum — Fabian Bäumer, Marcus Brinkmann, Marcel Maehren, and Jörg Schwenk — have discovered a critical security vulnerability affecting the SSH implementation in Erlang/OTP. Tracked as CVE-2025-32433, the flaw has been assigned a CVSS v3.1 score of 10.0, the highest possible severity rating. The vulnerability enables a malicious actor with network access to an Erlang/OTP SSH server to execute arbitrary code without any prior authentication. According to the researchers, the issue stems from a flaw in the SSH protocol message handling, where connection protocol messages sent prior to authentication can be exploited. All…

JFrog researchers have uncovered a new supply chain attack targeting cryptocurrency users through a malicious Python package uploaded to the PyPI repository. The package, named “ccxt-mexc-futures,” masqueraded as a legitimate tool for interacting with the MEXC cryptocurrency exchange but was designed to steal users’ crypto assets. According to JFrog, the package contained an “info-stealer” malware that harvested environment variables, hijacked cryptocurrency transactions, and exfiltrated sensitive data to an attacker-controlled server.   Specifically, it targeted users trading on MEXC by modifying withdrawal requests, rerouting tokens to wallets controlled by the threat actor. A Stealthy Operator The malware operated stealthily, making its malicious…