LIVE · cybersecurity feed
ai

Reporting from Vegas: Networking, AI, and good boys

zeroday.news·34d ago

The cybersecurity landscape is increasingly focused on the challenges and opportunities presented by artificial intelligence, particularly concerning data management and security infrastructure. Discussions at recent industry events highlight the significant hurdles businesses face in handling the vast amounts of data required for AI operations, especially in an agentic environment.

The sheer volume of data involved, potentially hundreds of zettabytes daily, presents a complex problem for organizations. Developing robust data pipelines and effective defense mechanisms for AI-driven processes is a key area of concern and innovation within the industry. Conferences serve as crucial venues for stakeholders to collaborate and brainstorm solutions for processing and protecting data at this unprecedented scale.

In response to evolving threats, Cisco Talos is enhancing its Threat Hunting program. This initiative aims to proactively identify advanced adversaries who can evade conventional detection methods. By integrating AI-powered telemetry analysis with human expertise, Talos seeks to uncover hidden threats across endpoint, network, and identity data.

This approach is designed to detect sophisticated intrusions before specific signatures are developed. Traditional security tools often rely on identifying known malicious patterns, but as threat actors leverage AI to operate with greater speed and stealth, this method can leave significant blind spots. Hypothesis-driven hunting addresses this by correlating subtle indicators across an environment, enabling defenders to piece together anomalies and identify complex attacks.

Cisco Talos is offering its Threat Hunting capabilities to organizations that may lack the internal resources for continuous hunting. Interested parties can contact their Cisco account team or explore a dedicated portal within Cisco Security Cloud Control. Further details on their recent investigation into KongTuke command-and-control activity are available in a detailed blog post.

In other security news, a global stock exchange has been targeted by a prolonged email campaign that granted attackers extensive access to an executive's inbox, reportedly by utilizing native Windows tools. Separately, a vulnerability in GitHub allows for the theft of full GitHub OAuth tokens through malicious VS Code extensions that exploit message-passing mechanisms.

The phishing-as-a-service platform "Kali365," previously focused on Microsoft 365, has expanded its scope to target AWS, Okta, and Russian platforms, employing device code phishing tactics. Additionally, numerous Red Hat packages distributed via its official NPM channel were found to contain malicious code, including a worm designed to steal credentials and sensitive data.

Web servers supporting HTTP/2 are potentially vulnerable to an exploit dubbed "HTTP/2 Bomb," which can cause them to go offline within seconds. This attack could affect a significant number of websites running common server configurations from NGINX, Apache HTTPD, Microsoft IIS, Envoy, or Cloudflare Pingora.

ai
← Back to latest

More News

view all →
zeroday.news · 4h ago·high

Operationalizing Day Minus Seven: The Cloud-Native ROC

The article introduces the concept of a Risk Operations Center (ROC) as a necessary evolution for cybersecurity teams facing AI-driven threats. It argues that traditional risk management models are insufficient due to the speed at which AI can discover and exploit vulnerabilities, especially in cloud environments. A ROC, powered by platforms like Qualys Enterprise TruRisk Management (ETM), aims to unify disparate security findings, hyper-prioritize risks based on exploitability and business impact, and enable autonomous remediation to keep pace with attackers.

zeroday.news · 4h ago·high

3 Ways AI Powers Service Desk Attacks and How to Prevent Them

Artificial intelligence is increasingly being used by attackers to enhance service desk attacks, particularly during employee onboarding. AI tools can create more convincing impersonations, accelerate reconnaissance for personalized attacks, and scale malicious campaigns. To counter these threats, organizations need to implement stronger identity verification methods, such as secure password delivery, biometric liveness detection, and multi-factor authentication before sensitive actions are approved.

zeroday.news · 3h ago·high

China-Linked APT Expands Arsenal With New ‘Leash’ Backdoors

A China-linked advanced persistent threat (APT) group, identified as LapDogs, has reportedly enhanced its malicious toolkit. Security researchers have observed the deployment of three new backdoors: LongLeash, DogLeash, and JarLeash, which are designed to compromise small office/home office (SOHO) routers.

zeroday.news · 3h ago·high

RedWing Android Spyware Sold as a Service on Telegram

A new Android spyware called RedWing is being offered as a service on Telegram, allowing less sophisticated attackers to compromise phones and steal banking information. Researchers have identified it as a polished malware-as-a-service operation with extensive documentation and a subscription model, potentially linked to Russian threat actors. RedWing employs fake login overlays, SMS interception, call forwarding, and even screen control to harvest credentials and conduct further malicious activities.

zeroday.news · 4h ago·critical

Ubiquiti Patches Critical UniFi Flaws Across Connect, Talk, Access, Protect, and OS

Ubiquiti has released security updates to address several critical vulnerabilities affecting its UniFi product line, including UniFi Connect, Talk, Access, Protect, and OS. These flaws could allow attackers to escalate privileges or execute arbitrary commands on affected devices. While no active exploitation has been reported for these specific vulnerabilities, the company has previously seen its UniFi OS and Edge OS products targeted by threat actors.

zeroday.news · 4h ago·high

Armored Likho Hits Government, Energy Sectors With BusySnake Stealer

Cybersecurity researchers have identified a new threat actor, dubbed Armored Likho, targeting government and energy sectors in Russia, Kazakhstan, and Brazil with a sophisticated phishing campaign. The operation utilizes a custom-built Python infostealer named BusySnake, designed to steal credentials, sensitive documents, and other high-value data. The attackers employ AI-generated payloads to obscure their activities and maintain persistence through various methods, including reverse SSH tunneling.