#cyberthreats

meterpreter.org

CISA Warns of Active Exploitation of Old Linux Flaws

A catastrophic vulnerability that lurked silently within the Linux kernel for nearly 14 years is now actively weaponized in real-world cyberattacks, alongside two other critical errors. The United States Cybersecurity and Infrastructure Security Agency (CISA) officially confirmed the active exploitation of these three flaws, adding them to its infamous Known Exploited Vulnerabilities catalog. CISA has mandated that all federal agencies urgently deploy available updates and mitigation strategies no later than September 22.

www.spreaker.com

Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware

https://www.osintinvestigate.com A Chinese-linked threat actor known as UTA0565 has been observed exploiting a Chrome-Windows zero-day chain to deliver CLEANGULP malware. The attacks, detected on September 3 and 4, 2026, combined two Google Chrome vulnerabilities and a Windows ALPC flaw to escape the browser sandbox and achieve remote code execution. The campaign used phishing emails, fake websites, hidden iframes, and impersonated media organizations and NGOs to deceive targeted victims. In this episode, we examine how the BlueMoon exploit chain was used, how CLEANGULP operates, and why the reuse of the same exploit kit across multiple threat actors is attracting attention from cybersecurity researchers.

ransomnews.online

ransomNews • your to-go source for ransomware intelligence

Verified data, monthly insights, and threat intelligence on global ransomware activity.

ipurple.team

Dump Encoding Library

The Windows Error Reporting Dump Encoding Library (WerEnc.dll) is a Microsoft signed DLL that can be abused by threat actors to encrypt their implant using a trusted Microsoft cryptographic impleme…

www.spreaker.com

Colorado Water Utilities Hit by Cyberattacks Targeting OT Systems

https://www.osintinvestigate.com Two small water utilities in Colorado were targeted by cyberattacks against their operational technology systems in late August 2026. Hackers reportedly changed equipment settings, disabled remote access and alarms, and altered pumping cycles. The disruptions were brief and did not affect water services or public safety, but the incidents highlight growing cybersecurity risks facing water and wastewater infrastructure. In this episode, we examine what happened, why OT and industrial control systems are attractive targets, the wider wave of attacks against US water utilities, and the security measures recommended by CISA.

www.spreaker.com

RatHat Android Trojan Uses AI to Control Devices: How AI-Powered Malware Threatens Android Users

https://www.osintinvestigate.com RatHat is a newly discovered Android Trojan that uses generative AI to navigate infected devices, steal credentials, capture user input, maintain persistence, and evade removal. In this episode, we explore how RatHat works, how attackers distribute it through smishing and malvertising, and why AI-powered automation could represent a new evolution in mobile malware.

thehackernews.com

Fake LastPass Authenticator Installer Abuses Microsoft-Signed Driver to Kill Antivirus and EDR

A fake LastPass Authenticator installer uses a signed kernel driver to kill security tools before a stealer collects passwords and wallet files.

thehackernews.com

Contagious Interview Campaign Compromises 30,000 Devices, Steals $10.71M in Crypto

North Korean Contagious Interview campaign compromised 30,000 devices and stole at least $10.71 million in cryptocurrency.

ransomnews.online

ransomNews • your to-go source for ransomware intelligence

Verified data, monthly insights, and threat intelligence on global ransomware activity.