CybersecurityBoard.com brings together vulnerability intelligence, security news, MITRE ATT&CK group profiles, cyber events, certifications, training, products, companies and service providers.
CVE-2021-24092 is a privilege escalation vulnerability in Microsoft Defender's BTR.sys driver, disclosed by SentinelLabs researcher Kasif Dekel in February 2021. It allowed a local non-administrator to overwrite arbitrary files by placing a hard link…
A set of improper neutralization of special elements vulnerabilities in Cisco Secure Workload could allow command, OS, and argument injection. CVSS score…
Multiple improper access control vulnerabilities in Cisco Secure Workload could allow privilege escalation and bypasses. CVSS score 10.0, fixed in versions 3.10.9.1…
Improper authentication vulnerabilities in Cisco Secure Workload could allow authentication bypass and reliance on untrusted inputs. CVSS score 10.0, fixed in versions…
Improper input validation vulnerabilities in Cisco Secure Workload could lead to path traversal and external path control. CVSS score 9.6, fixed in…
Improper restriction of operations within memory buffers in Cisco Secure Workload could allow buffer overflows and out-of-bounds writes. CVSS score 7.5, fixed…
Check Point Research has disclosed a technique that abuses Microsoft Defender's own legitimately signed boot-time remediation driver, BTR.sys, to perform arbitrary kernel-level…
The U.S. government has issued a joint advisory warning of an active threat targeting critical infrastructure organizations using AI-generated exploit scripts. The…
Adversa AI has disclosed a novel attack technique dubbed "Cryptographic Context Injection" that can cause xAI's Grok chatbot to exfiltrate a user's…
Researchers at the University of Massachusetts Amherst have demonstrated a novel attack, dubbed "Zombie Card," that can revive expired Visa contactless credit…
Cybersecurity researchers have disclosed two denial-of-service (DoS) attack techniques, collectively named "CDN Tsunami," that exploit how major content delivery networks (CDNs) convert…
In March 2026, Meta experienced a significant data exposure incident when an approved internal AI agent posted sensitive company and user data…
MoYu Group is a threat actor group attributed with high confidence to the BADBOX ad fraud and residential proxy scheme. They were…
FIN7 is a financially motivated cybercrime group that has been active since at least 2015. They are known for targeting the hospitality,…
Suspected Russian cyber espionage groups are abusing legitimate authentication flows, including Google OAuth and WhatsApp device linking, to hijack accounts across Europe…
UNC6293 is a suspected Russian cyber espionage sub-cluster of Ice Relic (APT29), first detailed in June 2025. It conducts small-scale phishing campaigns…
JarService is a dropper used by MoYu Group to deliver malware to Android-based car head units. It launches a loader that communicates…
zhima is a reverse proxy module documented by Nokia Deepfield Emergency Response Team. It is selectively delivered via IPTV apps and now…
Cybersecurity researchers have uncovered a new malware family specifically designed to infect Android-based vehicle head unit firmware developed by DoFun. Kaspersky, which…
AvNeutralizer is a malware tool used by threat actors like FIN7 to disable endpoint security software. It leverages legitimate signed drivers, such…
Researchers from UC Berkeley, the Ethereum Foundation, and NYU Shanghai presented a two-turn attack at USENIX Security 2026 that succeeded against Grok…
The Zombie Card attack was presented at the 35th USENIX Security Symposium held in Baltimore from August 12 to 14, 2026. The…
ISO/IEC 27001:2022 is an international information security management standard. Its Annex A includes access control and identity management controls that organizations can…
The GCIH certification demonstrates proficiency in incident handling and response, often pursued after SANS SEC504 training.
The SEC660 course at SANS Network Security 2026 teaches how to leverage AI for automating tasks while maintaining deep manual understanding of…
SANS SEC504 is a training course covering hacker tools, techniques, and incident handling, leading to GCIH certification.
TWCore is a legitimate system app on DoFun head units that collects analytics and updates software via MQTT. Threat actors weaponized its…
BTR.sys is a legitimate signed driver used by Microsoft Defender to remove malware after a reboot. It is embedded in MpEngine.dll and…
Sysmon is a Windows system service and device driver that logs system activity to the Windows event log, providing detailed telemetry on…
Windows Defender Application Control (WDAC) is a security feature that restricts which applications and drivers can run on a Windows system. It…
DoFun is the manufacturer of Android-based automotive head unit firmware that was exploited by MoYu Group to distribute malware through built-in updaters.…
HUMAN Satori is the threat intelligence and research team that previously exposed the BADBOX ad fraud and residential proxy scheme, linking it…
SentinelLabs is the research arm of SentinelOne, a cybersecurity company. It focuses on vulnerability research, threat hunting, and the discovery of advanced…
Wazuh is an open-source security platform that provides SIEM and XDR capabilities. It offers AI-powered features like the Wazuh AI Analyst for…
Seven malicious Firefox extensions use threat actor-controlled Supabase projects to dynamically serve phishing or decoy content, abusing the platform's infrastructure.
The 37 sports-score shell extensions share a hard-coded credential for API-Sports, a legitimate sports data service, indicating coordinated infrastructure.
Fifteen malicious Firefox extensions exfiltrate wallet secrets through Cloudflare Workers, leveraging the service for data theft.
msaRAT uses Twilio TURN relays to establish WebRTC DataChannels between the browser and C2 server.