Lmst

A high-severity flaw known as MongoBleed (CVE-2025-14847) is currently being exploited in the wild.

The scale is significant:

🔍 Wiz researchers have confirmed active exploitation.
📊 Data from Shodan and Censys reveals between 87,000 and 100,000 potentially vulnerable MongoDB instances.

#SecurityLand #CyberSecurity #InfoSec #MongoDB #MongoBleed #DatabaseSecurity #Wiz #Shodan #Censys #CloudSecurity

A five-month spearphishing operation discovered by Socket has transformed the npm registry into a durable hosting layer for AiTM credential theft, specifically targeting sales teams in the manufacturing and healthcare industries.

#SecurityLand #Cybersecurity #Research #NPM #Phishing #CriticalInfrastructure #AiTM #Spearphishing #Dev

Nissan Motor Co. confirms a data breach affecting 21,000 customers in Japan following a security incident at third-party vendor Red Hat. No financial data was stolen.

#SecurityLand #Cybersecurity #DataBreach #RedHat #Nissan #Japan #CrimsonCollective #ThreatActor

Switzerland's Federal Council has analyzed AI's growing influence on cybersecurity, revealing how it boosts both attacks and defenses while updating the National Cyberstrategy for better transparency. This report highlights risks like AI-powered phishing and deepfakes, alongside opportunities for faster threat detection.

#SecurityLand #News #Cybersecurity #AI #Switzerland #DigitalDefense #NationalSecurity

While the industry focused on securing the endpoint, the ground shifted. New data from Huntress and the Cloud Security Alliance confirms a staggering trend.

In our latest feature, we break down the "Inside-Out" Problem—the technical paradox where virtualization isolation actually shields attackers from guest-level security agents.

👇 READ THE FULL ANALYSIS: https://www.security.land/the-foundation-is-cracking-why-the-hypervisor-is-the-final-frontier-of-stealth-attacks/

#SecurityLand #ExpertDecode #CyberSecurity #Infosec #CloudSecurity #Huntress #Ransomware #Virtualization

How many of your dependencies have you actually audited lately?

ReversingLabs uncovered a 4-month campaign where attackers published 14 malicious packages on NuGet, all targeting cryptocurrency developers. These weren't sloppy hacks—they were sophisticated impersonations of legitimate blockchain tools like Nethereum and Coinbase.Net.Api.

#SecurityLand #CyberWatch #Malware #Blockchain #Crypto #Nethereum #Research

The Koi Security research team is on a roll this week.

After exposing the GhostPoster campaign that hid malware in Firefox extension logos, they've now uncovered something that should concern every developer using npm: a WhatsApp API package with 56,000 downloads that steals everything passing through it.

#SecurityLand #CyberWatch #NPM #WhatsApp #API #MaliciousPackage #Koi

The Handala group claims to have identified 14 Israeli engineers working on military drone programs—and placed $30,000 bounties on each of them. Israeli security sources haven't verified the breach, but this represents a troubling shift: from targeting infrastructure to targeting individuals with financial incentives for real-world harm.

#SecurityLand #GeoSphere #Cybersecurity #Cybercrime #Israel #Iran #Handala #ThreatActor #Infosec

The NCS Guide 2025 is here, and it finally solves the funding gap. With a new 6-phase lifecycle and a mandate for Quantum/AI foresight, this is the definitive playbook for digital sovereignty.

#SecurityLand #BusinessShield #Government #Cybersecurity #AI #Quantum #DigitalSovereignty #NCSGuide #NCS2025

A sophisticated threat actor with possible links to Russian hybrid-threat groups impersonated Trend Micro security advisories to target defense contractors, energy companies, and cybersecurity firms.

#SecurityLand #ThreatHorizon #APT #TrendMicro #ShadowVoid042 #Cybercrime #SpearPhishing

Analysis of CVE-2025-14733, a critical WatchGuard Firebox security vulnerability. Learn why unauthenticated RCE persists even after deleting vulnerable VPN configurations.

#SecurityLand #CyberWatch #ZeroDay #Watchguard #SecurityVulnerability #Firewall #CVE

Chinese threat actor UAT-9686 has been compromising Cisco email security systems since late November with a custom backdoor called AquaShell. Organizations should immediately check Cisco Talos advisories for indicators and remediation guidance.

#SecurityLand #ThreatHorizon #Cisco #UAT9686 #EmailSecurity #APT #China

Zscaler ThreatLabz documents BlindEagle APT's sophisticated attack on Colombian government infrastructure using steganography, compromised email accounts, and dual malware deployment (Caminho + DCRat). The September 2025 campaign demonstrates evolved tradecraft including Discord CDN abuse and fileless execution chains.

#SecurityLand #ThreatHorizon #Zscaler #BlindEagle #Colombia #Government #Ecuador #APT #RAT #Malware

Security researchers from Koi have uncovered 17 malicious Firefox extensions hiding multi-stage malware inside PNG logo files, affecting 50,000+ users. The sophisticated steganography-based campaign strips browser security protections and enables remote code execution while evading detection through probabilistic activation and delayed payloads.

#SecurityLand #ThreatHorizon #Steganography #Malware #PNG #BrowserSecurity #Cybersecurity

Australian Strategic Policy Institute research reveals how Chinese vision-language models systematically embed political censorship across multiple architectural layers. Testing of Qwen, Ernie, GLM, and DeepSeek shows 70%+ refusal rates for sensitive topics via certain providers, with language-dependent filtering that reshapes historical narratives.

#SecurityLand #GeoSphere #ASPI #Research #Australia #China #AI #LLM #Qwen #DeepSeek

The challenge of evolving cyber threats demands constant skill improvement. JSAC2026, hosted by JPCERT/CC in Tokyo (Jan 22-23), is the premier technical exchange for security analysts. Featuring deep-dives from Cisco Talos & Unit 42 on new MitM frameworks, Phishing-as-a-Service, and attributing complex APT campaigns.

#SecurityLand #News #Event #Cybersecurity #ThreatIntelligence #IncidentResponse #JSAC2026 #JPCERT #APT #MiTM

New research from ISC2 reveals a critical shift in cybersecurity workforce challenges. Their 2025 Cybersecurity Workforce Study surveyed 16,029 professionals globally and found that 88% of organizations experienced security incidents directly caused by skills deficits in the past year.

#SecurityLand #News #Research #ISC2 #Cybersecurity #Workforce #Study #SecurityIncident #CybersecurityJobs

New infrastructure analysis from Censys reveals how the pro-Russian hacktivist group NoName057(16) maintains DDoSia operations through rapid server rotation. Monitoring since mid-2025 shows an average of 6 control servers active simultaneously, but with a mean lifespan of only 2.53 days.

#SecurityLand #ThreatHorizon #Research #Censys #DDoSia #DDoS #DDoSAttack #NoName057 #Ukraine #Russia #Hacktivism

We got the The Oracle archetype!

https://mastodon.social/@securityland/wrapstodon/2025/104fdf6e234908d6

#Wrapstodon2025

A closer look at the Medusa ransomware group’s latest operations, including their evolving tactics and high-profile targets. Understand the current threat landscape and what defenders need to watch for.

#SecurityLand #BreachBreakdown #Ransomware #Medusa #RansomwareGroup #Cybercrime #Cybersecurity

Client Info