Published file metadata, source observations, indicators, and research history in one bounded catalog.
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
2 sources: 0 stale, 0 needing attention, 0 paused, 0 unverified.
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
First reported Oct 08, 2026 02:00 UTCCatalog metadata updated Oct 13, 2026 05:20 UTCOpen evidence recordOn October 5th, Atlassian published patches&#;x26;#;xc2;&#;x26;#;xa0;for multiple products to fix an "Arbitrary File Access" vulnerability &#;x26;#;x5b;CVE-2026-21589&#;x26;#;x5d;. An attacker can read arbitrary files in the web application&#;x26;#;39;s directory, potentially exposing sensitive information such as configuration files.
First reported Oct 07, 2026 14:59 UTCCatalog metadata updated Oct 13, 2026 05:20 UTCOpen evidence record(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
First reported Oct 13, 2026 02:00 UTCCatalog metadata updated Oct 13, 2026 05:20 UTCOpen evidence record(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
First reported Oct 07, 2026 02:00 UTCCatalog metadata updated Oct 13, 2026 05:20 UTCOpen evidence recordIt seems that a trend started… I continue my journey discovering more RMM ("Remote Management & Monitoring") tools abused by threat actors! A few days ago, I wrote a diary[1] about ScreenConnect used in the wild. Today, I found another one.
First reported Oct 06, 2026 13:16 UTCCatalog metadata updated Oct 13, 2026 05:20 UTCOpen evidence recordThe Traffic Light Protocol (TLP)[1], which is now in its second incarnation, is a wonderful standard that enables one to easily communicate whether information may be shared further (and if so, how far).
First reported Oct 10, 2026 09:11 UTCCatalog metadata updated Oct 13, 2026 05:20 UTCOpen evidence recordWe just did a major update to FOR577 and added a lot of new material on day 5 about investigating AI usage in incident response. In the new material we dicsuss 8&#;x26;#;xc2;&#;x26;#;xa0;of the most popular AI coding assistants and&#;x26;#;xc2;&#;x26;#;xa0;agents including Claude Code, Codex, Gemini CLI, Cursor, Copilot, Warp, Windsurf, and Qwen Code. I&#;x26;#;39;ve been using Claude Code and a little bit of Codex, but I also have recently been playing with OpenCode and am setting up Hermes. I decided to figure out where the chat history was in OpenCode and where any Hermes evidence might be located.
First reported Oct 08, 2026 16:52 UTCCatalog metadata updated Oct 13, 2026 05:20 UTCOpen evidence record(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
First reported Oct 06, 2026 11:45 UTCCatalog metadata updated Oct 13, 2026 05:20 UTCOpen evidence record(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
First reported Oct 09, 2026 07:52 UTCCatalog metadata updated Oct 13, 2026 05:20 UTCOpen evidence record(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
First reported Oct 12, 2026 02:00 UTCCatalog metadata updated Oct 13, 2026 05:20 UTCOpen evidence recordTổng hợp bởi AI Link gốc: https://archives.phrack.org/dl/73/halvar-flake-prophile.pdf Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor. Enroll Now and Save 10%: Coupon Code MWNEWS10 Note: Affiliate link – your enrollment helps support this platform at no extra cost to you. Article Link: 📖 PHRACK #73 PROPHILE — Halvar Flake | 0day in {REA_TEAM} 1 post - 1 participant Read full topic
First reported Oct 11, 2026 16:01 UTCCatalog metadata updated Oct 13, 2026 05:17 UTCOpen evidence recordHow to detect Azure Monitor transformation drops before they create blind spots in your security monitoring.Every hunt, detection rule and investigation starts with one assumption: the data in your workspace shows what actually happened.But it doesn’t always. It only shows the data that made it through the pipeline.That pipeline has a filter that many security teams have never reviewed. They may not know how much data it drops or monitor it for changes. If someone changes the filter, important events may stop reaching your tables. No alert fires because the data needed to trigger it is missing. Those events were dropped before they were ever stored.The good news is that dropped data leaves clues, just not where you would normally look.This article explains where the filter lives, why it sits outside the SOC’s usual view and which signals you can monitor to catch both malicious changes and simple configuration mistakes.Understanding Data TransformationsIn Azure Monitor and Microsoft Sentinel, data does not go straight from the source into your workspace. It first passes through a Data Collection Rule (DCR).The DCR decides what data to collect, how to change it and where to send it.One part of the DCR is the transformation. This is a KQL query that runs on every record as it arrives, before the record is written to a table. Microsoft defines the order clearly the transformation runs after the source sends the data and before it reaches the destination.Transformations are useful. You can drop noisy data you do not want to pay to store, remove columns you do not need or reshape logs into a common format. Microsoft recommends them for cost control, and in normal use they make sense.Here is the part of the DCR that matters:{ "dataFlows": [ { "streams": [ "Microsoft-Syslog" ], "destinations": [ "MyWorkspace" ], "transformKql": "source | where SeverityLevel != 'info'", "outputStream": "Microsoft-Syslog" } ]}The key line is transformKql. It is a KQL query stored in the configuration and every record must pass through it.In this example, it drops informational syslog messages. That is cheap, sensible and something nobody would question.But watch what happens when one extra line is added.The one-line blind spotStart with a transformation nobody would look at twice. It drops debug logs.source | where LogLevel != "DEBUG"Add one more condition.source| where LogLevel != "DEBUG"| where SourceIP != "10.20.20.20"Every event from that IP is now gone. It is not hidden in a table you can still query and it is not moved to a cheaper storage tier. It is removed before anything is written.No detection rule can alert on it, because rules query tables and the record never reached the table.An attacker using that IP address becomes invisible. And the thing hiding them is just one line in a configuration file.A transformation can quietly remove one column that your detection depends on.In that case, the events still arrive. The row count looks normal and nothing appears missing at first glance. But the field your rule relies on is blank in every record. The detection still runs, finds nothing and reports that everything is healthy.The Blind Spot Before the SOCA normal attacker with admin rights has to take action, generate logs and then clean up afterwards. That cleanup is still an action and it leaves traces. Purging a table, changing retention or deleting records are all things a decent SOC can detect.A transformation works differently. It acts before the log is created. There is no “after” to clean up.The evidence is not deleted. It is never stored in the first place. And you cannot write a detection for the deletion of something that never reached your tables.That is why whoever controls the DCR sits above the SOC not inside it.The SOC studies the data it receives. The DCR decides which data reaches the SOC. One controls
First reported Oct 10, 2026 20:25 UTCCatalog metadata updated Oct 13, 2026 05:17 UTCOpen evidence record오늘은 Snake Keylogger 계열 도면 문의의 건으로 위장한 키로그 악성코드 에 대해서 알아보겠습니다.파일명:도면 문의의 건.js사이즈:2 MBMD5:e89c8668c8b5041768a59c1532edf2adSHA-1:e66eead0b75cbc01f0f35f4a8394266a8bf2a380SHA-256:079932.. Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor. Enroll Now and Save 10%: Coupon Code MWNEWS10 Note: Affiliate link – your enrollment helps support this platform at no extra cost to you. Article Link: Snake Keylogger 계열 도면 문의의 건으로 위장한 키로그 악성코드-도면 문의의 건.js 1 post - 1 participant Read full topic
First reported Oct 11, 2026 17:01 UTCCatalog metadata updated Oct 13, 2026 05:17 UTCOpen evidence recordRitzau has more on the Denmark Central Person Register (CPR) breach: At least three accounts at the company linked to a major breach of Denmark’s CPR register reportedly used the password “123456”, including an administrator account. At least three user accounts at the Funen-based IT company Pays used the password “123456” when hackers gained access… Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor. Enroll Now and Save 10%: Coupon Code MWNEWS10 Note: Affiliate link – your enrollment helps support this platform at no extra cost to you. Source Article Link: https://databreaches.net/2026/10/10/123456-password-used-in-massive-danish-cpr-data-breach/ 1 post - 1 participant Read full topic
First reported Oct 10, 2026 20:55 UTCCatalog metadata updated Oct 13, 2026 05:17 UTCOpen evidence recordYou ignored the suspicious email. You didn’t open the attachment, click the link, or reply to the sender.Then you asked your AI assistant to summarize your inbox.Could the message you wisely avoided find its way back onto your to-do list—only this time presented as an urgent recommendation from a tool you trust?That’s the risk behind phishing emails containing hidden instructions aimed at AI assistants. Instead of relying only on persuading you, attackers are also trying to influence the software that reads your messages. Recent research from Barracuda describes emails designed to target both audiences at once.For the human recipient, there was a password-protected attachment, with the password supplied in the email. For an AI assistant processing the message, there were hidden instructions intended to influence how it summarized or handled the content.By including a prompt injection, attackers give themselves another way to reach you. The malicious instructions could try to make the assistant describe the email as legitimate or urgent, encouraging you to revisit it.In another example, a hidden block instructed a summarizing AI to add a fake priority action: Change a vendor’s payment details. That could result in an employee sending money to an attacker’s account.The attacker isn’t simply asking the AI to repeat a fraudulent request. They’re trying to turn that request into the assistant’s recommendation.How prompt injection worksPrompt injection means planting instructions in material an AI system is supposed to read, hoping it will follow those instructions instead of treating them as part of the material. When the instructions arrive through an outside source, such as an email or webpage, it’s often called indirect prompt injection.The malicious instructions don’t have to appear as ordinary, readable paragraphs. Barracuda identified concealment techniques including comments in the email’s underlying HTML code, text made invisible through styling, encoded content, and invisible “zero-width” characters. These can obscure instructions from a person viewing the message while leaving content available for an AI system to process. Whether that content actually reaches the model depends on how the particular tool extracts and prepares the email.That means this problem cannot be solved simply by asking people to look more carefully at their emails. Part of the defense must sit inside the tools handling those messages.Apollo Raines, developer of the AI code review service ShipItClean, explains:“The real flaw is that the model can’t tell the difference between text it’s supposed to read and instructions it’s supposed to follow. Stripping hidden content before it reaches the model is worth doing, and every vendor should do it. But it’s an arms race. Each new encoding trick is a new hole.”He adds:“People have learned to distrust the email. They haven’t learned to distrust their AI assistant. So, the defense has to live inside the tools. I’d go one step further: some of it has to live inside the model itself. Wrappers, filters, sandboxing and human sign-off on payments are all necessary.”Before taking actionAn assistant that summarizes messages could mislead you about which email deserves attention or what action it requires.An assistant with additional permissions could create a more serious problem. Depending on its capabilities and safeguards, malicious instructions might try to make it carry out unauthorized actions or disclose sensitive information.You don’t need to abandon AI tools that help with email. But you do need to consider what you trust them to do and what permissions you give them.The familiar phishing advice still applies. When an assistant reads your inbox on your behalf, check its recommendations before acting:Check the original message before acting on a recommendation involving money or sensitive information. If a summary tells you to pay an invoice, change account det
First reported Oct 12, 2026 11:20 UTCCatalog metadata updated Oct 13, 2026 05:17 UTCOpen evidence record<p>A Canadian cybersecurity executive who built a career helping organizations recover from cyberattacks has been arrested on federal extortion charges, a case that may be linked to the FBI&rsquo;s pursuit of the ShinyHunters hacking group that pilfered troves of bureau employee data.&nbsp;</p> Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor. Enroll Now and Save 10%: Coupon Code MWNEWS10 Note: Affiliate link – your enrollment helps support this platform at no extra cost to you. <p>Edward &ldquo;Ed&rdquo; Dubrovsky, 54, faces charges of conspiring to extort money by threatening to disclose stolen or hacked information and interfering with interstate commerce through extortion, according to<a href=“https://www.courtlistener.com/docket/74942095/united-states-v-dobrovsky/”> court records</a>. He appeared Thursday in federal court in Philadelphia, where a magistrate judge ordered him transferred to the Eastern District of Texas. Prosecutors are <a href=“https://storage.courtlistener.com/recap/gov.uscourts.paed.663480/gov.uscourts.paed.663480.3.0.pdf”>seeking his detention</a> pending trial.</p> <p><a href=“FBI Arrests Founder of Ransomware Negotiation Firm – Krebs on Security”>KrebsOnSecurity first identified Dubrovsky</a> on Friday night, citing sources linking his arrest to the ShinyHunters investigation. The New York Times had earlier reported that an unnamed Canadian man arrested in Pennsylvania was suspected of assisting the group, which claimed responsibility for a September breach exposing sensitive information about FBI employees.&nbsp;</p> <p>The complaint detailing the allegations against Dubrovsky remains sealed. His specific alleged conduct, including any role in the FBI intrusion linked to ShinyHunters, has not been publicly established.</p> <p>The arrest brings scrutiny to an executive whose professional reputation rested on helping victims navigate cyber incidents. Dubrovsky held leadership positions at incident-response companies, taught cybersecurity courses and recently published a book about how organizations should handle extortion incidents.&nbsp;</p> <p>He<a href=“Cyber Security Just Got Stronger As Iconic Operator Ed Dubrovsky Joins CYPFER”> joined CYPFER in 2022</a> to lead consulting and threat intelligence operations and later served as its chief operating officer and managing partner. The company&rsquo;s announcement described him as a veteran of three decades in cybersecurity and technology who had helped thousands of organizations recover from attacks and advised executives, lawyers and insurance carriers.&nbsp;</p> <p>Before that, Dubrovsky headed cyber breach response at Cytelligence, which Aon acquired in 2020. A<a href=“https://continue.yorku.ca/event/cyber-webi-s21-ondemand/”> York University biography</a> identified him as Cytelligence&rsquo;s chief operating officer and Aon&rsquo;s Canadian cyber leader. He also taught courses in cybersecurity engineering and security assessment and testing.&nbsp;</p> <p>More recently, Dubrovsky publicly promoted his work with CyberSteward, including ransomware negotiations and extortion advisory services. In a<a href=“https://ca.linkedin.com/in/edubrovs”> LinkedIn post</a> ahead of the NetDiligence Cyber Risk Summit in Philadelphia this month, he said he planned to attend with the company&rsquo;s team.&nbsp;</p> <p>FBI Director Kash Patel announced Friday that the bureau had <a href=“FBI arrests another ShinyHunters suspect after massive breach of employee data - Nextgov/FCW”>arrested</a> another suspected ShinyHunters co-conspirator, without naming the person or disclosing charges. Canadia
First reported Oct 10, 2026 16:20 UTCCatalog metadata updated Oct 13, 2026 05:17 UTCOpen evidence record﷽ Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor. Enroll Now and Save 10%: Coupon Code MWNEWS10 Note: Affiliate link – your enrollment helps support this platform at no extra cost to you. Hello, cybersecurity enthusiasts and white hackers! In part 1 we reversed the WAMR .aot container from real bytes and wrote unaot - a tiny, dependency-free C parser that verifies the \0aot magic, walks the section table (handling the 4-byte alignment rule), and decodes TARGET_INFO so we know exactly which CPU the embedded TEXT blob is compiled for. That told us where the native code is and how to disassemble it. But a disassembly of a few hundred anonymous functions is nearly useless. What a reverse engineer actually wants is names: which blob of machine code is add, which is fib, which is the exported entry point. This part builds exactly that - a symbolized function table - by decoding two more sections, EXPORT and FUNCTION, and joining them. We will also give the tool some color so the output is readable. Still one small C file, still no libraries. the plan The information we need is split across two sections, and neither one is enough on its own: FUNCTION gives us, for every defined function, the offset into TEXT where its native code starts (and its type index). It gives us the geography - but no names. EXPORT gives us names mapped to function indices - but no offsets. The two share a key: the function index. So the whole trick of part 2 is: Decode both, join on the index, and we have a symbol table that maps every native function to a name and a precise file offset. Let’s take the sections one at a time. the EXPORT section EXPORT is the name source. Its layout (from WAMR’s aot_loader.c, load_export_section) is a count followed by that many export entries: u32 count entry[count]: u32 index (4-byte aligned) u8 kind 0=func 1=table 2=memory 3=global 4=tag str name The one part that will trip you up is how WAMR stores a string. It is not a plain C string and not a bare length-prefixed buffer. It is: u16 length (2-byte aligned) u8 bytes[length] <- the trailing '\0' IS counted in length So a name like add is stored with length = 4: the three characters a, d, d, plus a trailing NUL that is included in the count. If you print length bytes you get a stray NUL at the end; if you assume the length excludes the terminator you read one byte short on the next field and desync. We copy length bytes and then drop the last one. Here is decode_export. Note the two alignment steps - index is 4-aligned, the string length is 2-aligned - mirroring the loader’s alignment-aware reads from part 1: /* EXPORT: u32 count, then { u32 index(align4), u8 kind, string name }. * string = u16 len(align2) + len bytes (trailing '\0' counted in len). */ static void decode_export(reader_t *r, size_t body, uint32_t size) { size_t end = body + size, pos = body; uint32_t count = rd_u32_at(r, pos); pos += 4; if (r->err) { printf(" <export truncated>\n"); return; } printf(" %u export(s):\n", count); for (uint32_t i = 0; i < count; i++) { pos = align_up(pos, 4); uint32_t index = rd_u32_at(r, pos); pos += 4; uint8_t kind = rd_u8_at(r, pos); pos += 1; pos = align_up(pos, 2); uint16_t slen = rd_u16_at(r, pos); pos += 2; if (r->err || pos + slen > end) { printf(" <export %u truncated>\n", i); break; } char name[96]; size_t n = slen < sizeof(name) ? slen : sizeof(name) - 1; for (size_t j = 0; j < n; j++) name[j] = (char) rd_u8_at(r, pos + j); name[n ? n - 1 : 0] = 0; /* drop the counted trailing '\0' */ pos += slen; printf(" [%u] %-6s index=%-3u \"%s\"\n", i, export_kind_name(kind), index, name); if (kind == 0 && g_expn < MAXF) { /* remember func names for symbolization */
First reported Oct 12, 2026 05:26 UTCCatalog metadata updated Oct 13, 2026 05:17 UTCOpen evidence recordIntroduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor. Enroll Now and Save 10%: Coupon Code MWNEWS10 Note: Affiliate link – your enrollment helps support this platform at no extra cost to you. The Credit Union Cybersecurity Handbook Protect member data and essential banking services with a practical guide to credit union cybersecurity. Written for U.S. credit union security leaders, IT teams, executives, and boards, this handbook covers cyber threats, ransomware, NCUA compliance, third-party risk, and security maturity. Article Link: Validate Cyber Readiness Across Every Credit Union System 1 post - 1 participant Read full topic
First reported Oct 12, 2026 18:30 UTCCatalog metadata updated Oct 13, 2026 05:17 UTCOpen evidence recordDiscover how Arctic Wolf and Veeam help organizations monitor backup infrastructure, detect suspicious activity, and correlate security events to strengthen threat detection and response. Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor. Enroll Now and Save 10%: Coupon Code MWNEWS10 Note: Affiliate link – your enrollment helps support this platform at no extra cost to you. Article Link: https://arcticwolf.com/resources/datasheet/veeam-arctic-wolf/ 1 post - 1 participant Read full topic
First reported Oct 12, 2026 20:05 UTCCatalog metadata updated Oct 13, 2026 05:17 UTCOpen evidence recordDDoS protection combines tools and techniques to detect and filter malicious traffic from a distributed denial-of-service (DDoS) attack before it overwhelms a website, server, or network. It identifies attack traffic, absorbs or scrubs it away from your infrastructure, and lets legitimate requests through, usually automatically and within seconds. Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor. Enroll Now and Save 10%: Coupon Code MWNEWS10 Note: Affiliate link – your enrollment helps support this platform at no extra cost to you. The need is no longer occasional. Cloudflare reported mitigating 23.2 million network-layer DDoS attacks in the first half of 2026 alone, roughly 5,300 attacks per hour. This guide explains how DDoS protection works, the types available, and how to protect a website, server, or network of any size. What Is DDoS Protection? DDoS protection is the set of defenses that keeps a website, server, or network online during a distributed denial-of-service attack. It detects malicious traffic and filters it out before it reaches your infrastructure. Its goal is availability: legitimate users keep getting through while attackers flood the target with junk requests. It can be delivered as a cloud service, on-premises hardware, or a mix of both. DDoS vs. DoS: What “Denial of Service Protection” Means Denial of service protection defends against attacks that make a system unavailable to users. DDoS protection is designed for attacks that come from many sources at once. In a DoS attack, one machine or connection sends the flood, so blocking that single source usually stops it. In a DDoS attack, thousands or millions of compromised devices, known as a botnet, send traffic simultaneously. No single address to block, so defenses must distinguish attack traffic from real visitors across the whole stream. In practice, “DoS protection,” “denial of service protection,” and “DDoS protection” are used interchangeably, because the distributed variety is the one that demands dedicated defenses. DDoS Protection Meaning in Plain English DDoS protection works like a bouncer at your website’s front door. When a crowd of fake visitors tries to jam the entrance, it turns them away and keeps the line moving for real customers. Technically, it watches incoming traffic, learns what normal looks like, and spots surges or patterns that don’t fit. It then blocks, filters, or redirects that traffic while normal requests keep loading. It can cover websites, servers, DNS, APIs, and entire networks. DDoS Protection vs. DDoS Mitigation: Are They the Same? They overlap heavily, but they are not identical. DDoS mitigation absorbs and filters attack traffic while an attack is underway. DDoS protection is the broader capability: preparation, detection, mitigation, monitoring, and recovery planning together. Mitigation is the response; protection is the whole system that makes it possible. The difference matters because of speed. Cloudflare found that about 90% of the network-layer attacks it mitigated in the first half of 2026 ended in under 10 minutes, which is too fast for anyone to respond by hand. When evaluating a “DDoS mitigation service” or a “DDoS protection service,” look past the label and confirm that detection and mitigation are automated and always on. Why DDoS Protection Matters DDoS protection matters because a successful attack takes your site, app, or network offline when customers need it most, and the cost is lost revenue, staff time, and trust. Attackers can rent this capability cheaply, and almost any business with an online presence can be a target. Protection is what keeps an attack from turning into an outage. What a DDoS Attack Can Cost Your Business A DDoS attack costs a business money in three ways: lost revenue while services are down, the staff and emergency spend needed to recover, and lasting
First reported Oct 12, 2026 10:40 UTCCatalog metadata updated Oct 13, 2026 05:17 UTCOpen evidence recordHackers breached ASOS, a UK-based global online fashion retailer with many customers in the USA, earlier this month. The hackers stole the names, addresses, DOBs, and contact information of millions of ASOS customers. While the exact number of affected customers remains unknown, the fashion powerhouse has tens of millions of customers, with about 20% of its traffic coming from the USA. The ASOS leadership acknowledged the breach after many customers sounded the alarm on social media after receiving unauthorized push notifications on their smartphones. The cybercriminals used the notification to wreak havoc and to disclose that they had compromised customers’ details. The hackers threatened to leak the stolen information unless ASOS agreed to “engage with them,” likely demanding a ransom in return. Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor. Enroll Now and Save 10%: Coupon Code MWNEWS10 Note: Affiliate link – your enrollment helps support this platform at no extra cost to you. Key takeaways ASOS suffered a data breach in which hackers stole the names, addresses, DOBs, and contact details of millions of customers. ASOS affected millions of Americans, as the company serves millions of US customers and operates a warehouse in Dallas, Texas. Attackers used social engineering to steal employee credentials and demanded a ransom. Stolen data can enable future phishing attacks and may appear on the dark web. Were any Americans affected by the ASOS data breach? Yes, Americans were affected. The online fashion retailer has a fulfillment warehouse in Texas and millions of customers in the USA, who use its US website and recently launched app. The fashion app is on both the Google Play Store and the App Store, ranks in the top 40 most-downloaded apps on the App Store shopping chart, and has 10+ million downloads on the Google Play Store. The online fashion retailer also has a strong presence in other countries, including its home country, the United Kingdom, and Australia. How did the criminals compromise ASOS, and who is behind the attack? The hackers penetrated ASOS through social engineering. ASOS admitted that the fraudsters successfully impersonated a trusted contact and obtained login credentials to its systems. Once inside, they downloaded sensitive information and approached the fashion company for ransom. The cybercriminal group Xuanyewen (@xuanyegroup), which has previously used the names JohnCZ (@JohnCzwartacki) and Moon Transfers (@NFTmoonstock) on Telegram, appears to be behind the attack. However, while the motive is clear, as the fraudsters are after monetary gains, the exact location of the attackers and their real identity remain unknown. What can the criminals do with the stolen information? Criminals can use the stolen information for future attacks. Data from company leaks and breaches often remains on the internet forever, and many data points rarely change, such as names and DOBs, meaning that years from now people might receive highly personalized, hard-to-spot malicious emails, text messages, or even phone calls that could cause trouble. Even if ASOS satisfied the hackers’ requests, there is no guarantee those details won’t end up on the dark web, since cyber thieves have no moral compass. Data breaches happen often, and hackers use stolen information for nefarious purposes. Smartphone users should protect their devices by installing antivirus software on all connected devices. An extra layer of security is often what deters hackers from successfully utilizing stolen data to commit fraud. The post Global Online Retailer ASOS Has Been Hacked appeared first on Panda Security Mediacenter. Article Link: ASOS Data Breach: Are Your Details Safe? - Panda Security 1 post - 1 participant Read full topic
First reported Oct 12, 2026 07:35 UTCCatalog metadata updated Oct 13, 2026 05:17 UTCOpen evidence recordThe FBI is doing another victory dance after arresting someone they allege assisted ShinyHunters with the FBI Jobs attack. Brian Krebs reports: Agents with the Federal Bureau of Investigation (FBI) on Thursday arrested the co-founder of a Canadian cybersecurity firm in connection with an investigation into the ShinyHunters hacking group that recently relieved the FBI… Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor. Enroll Now and Save 10%: Coupon Code MWNEWS10 Note: Affiliate link – your enrollment helps support this platform at no extra cost to you. Source Article Link: https://databreaches.net/2026/10/10/fbi-announces-yet-another-arrest-allegedly-connected-to-the-fbi-jobs-hack/ 1 post - 1 participant Read full topic
First reported Oct 10, 2026 12:15 UTCCatalog metadata updated Oct 13, 2026 05:17 UTCOpen evidence record40 + 40=80. That’s how old Raheim Hamilton will be when he gets out of prison if he serves his full sentence. There’s an update to a previously reported case. October 7, CHICAGO — A Virginia man who co-created and operated “Empire Market”—a dark web marketplace that enabled users to anonymously buy and sell illegal… Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor. Enroll Now and Save 10%: Coupon Code MWNEWS10 Note: Affiliate link – your enrollment helps support this platform at no extra cost to you. Source Article Link: https://databreaches.net/2026/10/12/co-creator-of-dark-web-marketplace-sentenced-to-40-years-in-federal-prison/ 1 post - 1 participant Read full topic
First reported Oct 12, 2026 12:21 UTCCatalog metadata updated Oct 13, 2026 05:17 UTCOpen evidence recordI releasing a new version of my beta tool onedump.py to list files embedded inside OneNote files (.one). I had to extract all the embedded files out of a set of .one files. This update adds option –jsonoutput that helps with this problem. Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor. Enroll Now and Save 10%: Coupon Code MWNEWS10 Note: Affiliate link – your enrollment helps support this platform at no extra cost to you. Running command “onedump.py –jsonoutput *.one” will create a JSON document containing all embedded files inside all *.one files. I can then write these files to disk with my myjson-filter.py tool, like this: onedump.py –jsonoutput *.one | myjson-filter.py -W hashvir Article Link: Update: onedump.py Version 0.0.3 | Didier Stevens 1 post - 1 participant Read full topic
First reported Oct 12, 2026 15:56 UTCCatalog metadata updated Oct 13, 2026 05:17 UTCOpen evidence recordThe public shared-host view reaches the newest 2,400 matching records. Narrow the filters or search an exact MD5, SHA-1, or SHA-256 value to reach a specific record.
A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.