The cyber underground’s been busy, Digital Defenders. |
Old flaws are rising from the grave, AI’s learning new tricks, and malware’s getting eerily human.
From stealthy Windows hijacks to reanimated Magento exploits, this week’s threats prove one thing: what’s old isn’t gone. It’s just waiting to strike again. |
|
|
Here’s what you need to know: |
|
|
Trusted Windows Feature Abused for Stealthy DLL Attacks |
TrustedSec researchers have uncovered a persistence technique that revives a decade-old Windows flaw.
A DLL hijack in Windows Narrator (affecting Windows 10 and 11) allows attackers with local admin rights to gain stealthy SYSTEM-level persistence and lateral movement — even across RDP — because Narrator can launch before user logon. |
Source: Simon Rayl/Unsplash |
The researchers have not reported the attack being used in the wild.
Enforce least privilege, restrict and monitor write access to critical DLL and registry paths, apply allowlisting, harden remote administration, and deploy host-level detection for injection or thread-suspension activity. |
SessionReaper Strikes: Old Magento Bug Fuels New Attacks |
Akamai researchers have confirmed active exploitation of a critical Adobe Commerce (formerly Magento) vulnerability known as SessionReaper.
Tracked as CVE-2025-54236, the flaw lets attackers hijack sessions and run remote code. Within days of the PoC’s release, 300+ attacks targeted 130+ hosts, enabling web shell implants for full server takeover and data theft.
Adobe has already released a patch for the vulnerability. Patch, harden servers, restrict admin access, monitor for web shells, and maintain layered defenses with WAFs and regular scans. |
BlueNoroff Wields AI to Target Global Executives |
Researchers at Kaspersky uncovered new details about BlueNoroff, a Lazarus Group offshoot that uses AI-driven GhostCall and GhostHire attacks.
Active since April 2025, these campaigns target crypto, blockchain, and tech professionals worldwide. GhostCall uses fake video meetings and GhostHire involves fake recruiters. Both campaigns are still active in the wild.
Verify unsolicited contacts, use secure communication tools, limit admin access, deploy EDR, keep systems patched, and train employees to spot social engineering attempts. |
|
|
How ready is your team for relic exploits? |
|
|
Yesterday's Pulse Check Results |
AI Oversight Reality Check: Who’s really watching your robots? |
|
|
Security Tools You Can Use |
|
|
Herodotus Trojan Tricks Banks by Typing Like You |
ThreatFabric researchers discovered Herodotus, an Android banking Trojan that mimics human behavior to evade anti-fraud and biometric defenses.
Unlike typical malware, Herodotus types with human-like pauses to mimic real users, enabling convincing fraud while stealing credentials, intercepting 2FA codes, and taking remote control. |
The malware is active in Italy and Brazil and blends behavioral mimicry with MaaS distribution, signaling a new wave of mobile threats that defeat behavior-based fraud detection.
Use MDM and EDR tools, monitor behavior and device telemetry, secure apps, educate users on safe practices, track threat intelligence, and adopt adaptive authentication for stronger mobile defense. |
Privilege Escalation Bug Hits Ubuntu Kernel |
A critical Ubuntu kernel vulnerability exposes version 24.04.2 (kernel 6.8.0-60) to full privilege escalation. Incomplete patching in af_unix.c and garbage.c created a use-after-free flaw that was exploited for root access. Such kernel bugs are severe, letting attackers bypass isolation, steal data, and disable security controls with minimal patch gaps.
Ubuntu has already released a patch for the vulnerability. Patch immediately, enable Secure Boot and lockdown mode, restrict kernel access, monitor for anomalies, and enforce AppArmor or SELinux for containment. |
|
|
Is your AI security ready for 2026?
AI vulnerabilities are multiplying, and defenses are struggling to keep up. 2026 will demand bold, proactive strategies. Are your systems ready? Join Uncharted: The AI Safety & Security Summit for exclusive insights, proven tactics and actionable plans to safeguard your organization. Don’t wait until it’s too late. |
|
|
When Was the Last Time You Hardened Your Linux Systems? |
As Linux drives enterprise servers, cloud workloads, and containers, it’s a prime target for misconfigurations and unpatched flaws — making hardening essential to protect against privilege escalation, lateral movement, and data theft. |
Source: Gabriel Heinzer/Unsplash |
How to harden your Linux systems against attacks: |
-
Access and authentication: Enforce least privilege, use strong authentication methods, and disable unnecessary accounts or services to minimize entry points for attackers.
-
Secure configurations and patching: Regularly update systems, apply security patches, follow hardened configuration baselines to reduce exposure to known vulnerabilities, and automate where you can to reduce misconfigurations.
-
Continuously monitor: Implement comprehensive logging, network and system monitoring, and intrusion detection to quickly identify and respond to suspicious activity.
|
Consistent Linux hardening strengthens cyber resilience against both automated and targeted attacks by tightening access, maintaining visibility, and keeping systems up to date. |
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2025 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
