Kirsten Doyle

Researchers at CYFIRMA have discovered a new version of Neptune RAT, a highly advanced Remote Access Trojan (RAT) that targets Windows systems. Written in Visual Basic .NET, this scourge has been spreading rapidly across platforms such as GitHub, Telegram, and YouTube, where it is being marketed with phrases like “Most Advanced RAT.” “This indicates its widespread use by cybercriminals targeting Windows users,” the researchers said, adding that the RAT’s author has made the malware available without the source code, intentionally obfuscating the executable files to make analysis more difficult. “Although the developer claims it is a free version, they hint…

Cybersecurity officials in the US, Australia, Canada, New Zealand, and the UK have collectively warned against a new cyber threat dubbed “fast flux.” This tactic is being used by hackers to hide malicious websites and avoid shutdown.  What is Fast Flux? Fast flux is a method whereby malicious attackers quickly change the IP addresses that a domain name is linked to so that it becomes more difficult for defenders to block or track malicious sites because they’re always on the move. There are two main types: Keeping Malicious Content Online Fast flux is often used to keep phishing sites, malware…

The European Union is preparing to dial back certain provisions of the General Data Protection Regulation (GDPR), one of its most widely known and complex tech legislations, reports Politico The intention is to lighten the regulatory load on businesses, particularly small and medium-sized enterprises (SMEs), and allow them to compete more effectively with those in the U.S., China, and elsewhere.  The European Commission will present a proposal in coming weeks to simplify the GDPR. It is a part of broader efforts led by Commission President Ursula von der Leyen to slash red tape and make EU regulation more pro-business. The Commission has already put forward such simplification proposals in other areas like sustainability reporting and access to EU funds. Struggling With Complexity Since its launch in 2018, the GDPR has compelled companies to follow strict rules…

The Royal Mail Group, one of the UK’s oldest institutions, is in the hot seat, following an alleged data breach that exposed 144GB of internal and customer information. The leak was announced on 31 March 2025, by a hacker known as “GHNA” on the cybercrime platform Breach Forum. According to Hackread.com, the leaked archive contains 293 folders and more than 16,000 files, including sensitive customer PII (names, addresses, and shipping details), internal communications like Zoom recordings, backend SQL databases, and Mailchimp marketing data. One video even shows a meeting between Royal Mail and Spectos, that operates globally in the fields…

GreyNoise researchers have observed a dramatic surge in login scanning activity targeting Palo Alto Networks PAN-OS GlobalProtect portals. Over the last 30 days, almost 24,000 unique IP addresses have attempted to access these portals. The pattern suggests a coordinated effort to probe network defenses and identify exposed or vulnerable systems, potentially as a precursor to targeted exploitation. The surge is said to have begun on March 17, sustaining at nearly 20,000 unique IP addresses per day before dropping off on March 26. At its peak, 23,958 unique IP addresses are estimated to have participated in the activity. Of these, only…

The Cybersecurity & Infrastructure Security Agency (CISA) has issued urgent alerts warning of multiple critical vulnerabilities affecting Industrial Control Systems (ICS), including Hitachi Energy MicroSCADA Pro/X SYS600 and Rockwell Automation Lifecycle Services with Veeam Backup and Replication.   These security flaws, some remotely exploitable, could allow malicious actors to execute code, manipulate critical files, hijack sessions, and launch phishing attacks against industrial networks. Hitachi Energy Vulnerabilities With a CVSS v3 score of up to 9.9 (Critical), the vulnerabilities in Hitachi Energy MicroSCADA Pro/X SYS600 could pose major security risks, including code injection, unauthorized system file access, session hijacking, and phishing. Affected…

Security researcher Evan Connelly recently identified a security vulnerability in the Verizon Call Filter iOS app which made it possible for a malicious actor to leak call history logs of Verizon Wireless customers. Call logs can be highly valuable, particularly for nation-states, as they enable intelligence agencies to map social networks, track high-value targets, figure out communication patterns, and correlate metadata with other surveillance data to uncover covert operations or political affiliations. This was evident in the recent coverage of the Salt Typhoon breach of telecom networks. “Given that this data is of such value, you’d expect that both how…

A non-password-protected database that contained just under 100k records belonging to GenNomis by AI-NOMIS —was discovered by cybersecurity researcher Jeremiah Fowler, who reported his findings to vpnMentor. GenNomis by AI-NOMIS is an AI company based in South Korea that provides face swapping and “Nudify” adult content as well as a marketplace where images can be bought or sold The database was neither password-protected nor encrypted and contained 93,485 images and JSON files—in total 47.8 GB of data. A sample of the exposed records included a slew of pornographic images, some of which appeared to depict AI-generated pictures of ‘very young…

Security researchers at ThreatFabric have uncovered Crocodilus, a new and highly capable mobile banking Trojan that features modern attack techniques, including remote control, black screen overlays, and advanced data harvesting via accessibility logging.  During routine threat-hunting operations, analysts identified these previously unseen malware samples. Dubbed “Crocodilus” after references left by its developers (who call it “Crocodile”), this Trojan exhibits all the hallmarks of a modern banking malware: overlay attacks, keylogging, remote access, and hidden control capabilities. ThreatFabric’s initial analysis revealed that Crocodilus seems to be mainly targeting financial institutions in Spain and Turkey, as well as several cryptocurrency wallets. However,…

Elon Musk’s social media platform, X, has once again made headlines—for all the wrong reasons. Following reports of xAI’s $33B purchase of X, claims of bad actors being behind platform outages, and X password scams targeting users, another concerning development has emerged. A data enthusiast called ThinkingOne has released a database allegedly containing details of around 200 million X user records. Here’s what we know so far. X Vulnerability Exploited to Access User Data The origins of this breach date back to January 2022, when Twitter, as it was then known, identified a vulnerability through its bug bounty program. This flaw…