Kirsten Doyle

The Royal Mail Group, one of the UK’s oldest institutions, is in the hot seat, following an alleged data breach that exposed 144GB of internal and customer information. The leak was announced on 31 March 2025, by a hacker known as “GHNA” on the cybercrime platform Breach Forum. According to Hackread.com, the leaked archive contains 293 folders and more than 16,000 files, including sensitive customer PII (names, addresses, and shipping details), internal communications like Zoom recordings, backend SQL databases, and Mailchimp marketing data. One video even shows a meeting between Royal Mail and Spectos, that operates globally in the fields…

GreyNoise researchers have observed a dramatic surge in login scanning activity targeting Palo Alto Networks PAN-OS GlobalProtect portals. Over the last 30 days, almost 24,000 unique IP addresses have attempted to access these portals. The pattern suggests a coordinated effort to probe network defenses and identify exposed or vulnerable systems, potentially as a precursor to targeted exploitation. The surge is said to have begun on March 17, sustaining at nearly 20,000 unique IP addresses per day before dropping off on March 26. At its peak, 23,958 unique IP addresses are estimated to have participated in the activity. Of these, only…

The Cybersecurity & Infrastructure Security Agency (CISA) has issued urgent alerts warning of multiple critical vulnerabilities affecting Industrial Control Systems (ICS), including Hitachi Energy MicroSCADA Pro/X SYS600 and Rockwell Automation Lifecycle Services with Veeam Backup and Replication.   These security flaws, some remotely exploitable, could allow malicious actors to execute code, manipulate critical files, hijack sessions, and launch phishing attacks against industrial networks. Hitachi Energy Vulnerabilities With a CVSS v3 score of up to 9.9 (Critical), the vulnerabilities in Hitachi Energy MicroSCADA Pro/X SYS600 could pose major security risks, including code injection, unauthorized system file access, session hijacking, and phishing. Affected…

Security researcher Evan Connelly recently identified a security vulnerability in the Verizon Call Filter iOS app which made it possible for a malicious actor to leak call history logs of Verizon Wireless customers. Call logs can be highly valuable, particularly for nation-states, as they enable intelligence agencies to map social networks, track high-value targets, figure out communication patterns, and correlate metadata with other surveillance data to uncover covert operations or political affiliations. This was evident in the recent coverage of the Salt Typhoon breach of telecom networks. “Given that this data is of such value, you’d expect that both how…

A non-password-protected database that contained just under 100k records belonging to GenNomis by AI-NOMIS —was discovered by cybersecurity researcher Jeremiah Fowler, who reported his findings to vpnMentor. GenNomis by AI-NOMIS is an AI company based in South Korea that provides face swapping and “Nudify” adult content as well as a marketplace where images can be bought or sold The database was neither password-protected nor encrypted and contained 93,485 images and JSON files—in total 47.8 GB of data. A sample of the exposed records included a slew of pornographic images, some of which appeared to depict AI-generated pictures of ‘very young…

Security researchers at ThreatFabric have uncovered Crocodilus, a new and highly capable mobile banking Trojan that features modern attack techniques, including remote control, black screen overlays, and advanced data harvesting via accessibility logging.  During routine threat-hunting operations, analysts identified these previously unseen malware samples. Dubbed “Crocodilus” after references left by its developers (who call it “Crocodile”), this Trojan exhibits all the hallmarks of a modern banking malware: overlay attacks, keylogging, remote access, and hidden control capabilities. ThreatFabric’s initial analysis revealed that Crocodilus seems to be mainly targeting financial institutions in Spain and Turkey, as well as several cryptocurrency wallets. However,…

Elon Musk’s social media platform, X, has once again made headlines—for all the wrong reasons. Following reports of xAI’s $33B purchase of X, claims of bad actors being behind platform outages, and X password scams targeting users, another concerning development has emerged. A data enthusiast called ThinkingOne has released a database allegedly containing details of around 200 million X user records. Here’s what we know so far. X Vulnerability Exploited to Access User Data The origins of this breach date back to January 2022, when Twitter, as it was then known, identified a vulnerability through its bug bounty program. This flaw…

iOS apps that cater to sugar dating, BDSM, and LGBTQ+ communities – where privacy is critical – have leaked highly sensitive content, putting users of these apps at risk.   Cybernews researchers discovered that apps from BDSM People, CHICA, TRANSLOVE, PINK, and BRISH had publicly accessible secrets published together with the apps’ code, including API keys, passwords, and encryption keys. It is highly dangerous to expose these, as credentials in client applications are accessible to anyone, and can be abused by malicious actors to gain a foothold on systems. In this instance, the most dangerous of leaked secrets granted access to…

A new cybersecurity report from Forescout Technologies has unveiled significant vulnerabilities in solar power systems that could potentially destabilize power grids and compromise consumer data privacy. The report, titled “SUN:DOWN – Destabilizing the Grid via Orchestrated Exploitation of Solar Power Systems,” details several key findings: According to Barry Mainz, Forescout CEO, “The collective impact of residential solar systems on grid reliability is too significant to ignore – hospitals could lose access to critical equipment, families could go without heat in the winter or AC in a heatwave, and businesses could shut down. Threat actors increasingly target critical infrastructure, making it…

The Qualys Threat Research Unit (TRU) has uncovered three security bypasses in Ubuntu’s unprivileged user namespace restrictions. Researchers disclosed these vulnerabilities to the Ubuntu Security Team on 15 January this year, has been working with then ever since. Researchers found three distinct bypasses of these namespace restrictions, each of which would allow bad actors to create user namespaces with full administrative capabilities. “These bypasses facilitate exploiting vulnerabilities in kernel components requiring powerful administrative privileges within a confined environment. The restrictions on unprivileged user namespaces were initially introduced in Ubuntu 23.10 and enabled by default in Ubuntu 24.04,” Qualys explained. The…