CybersecurityBoard.com brings together vulnerability intelligence, security news, MITRE ATT&CK group profiles, cyber events, certifications, training, products, companies and service providers.
CVE-2021-24092 is a privilege escalation vulnerability in Microsoft Defender's BTR.sys driver, disclosed by SentinelLabs researcher Kasif Dekel in February 2021. It allowed a local non-administrator to overwrite arbitrary files by placing a hard link…
A set of improper neutralization of special elements vulnerabilities in Cisco Secure Workload could allow command, OS, and argument injection. CVSS score…
Multiple improper access control vulnerabilities in Cisco Secure Workload could allow privilege escalation and bypasses. CVSS score 10.0, fixed in versions 3.10.9.1…
Improper authentication vulnerabilities in Cisco Secure Workload could allow authentication bypass and reliance on untrusted inputs. CVSS score 10.0, fixed in versions…
Improper input validation vulnerabilities in Cisco Secure Workload could lead to path traversal and external path control. CVSS score 9.6, fixed in…
Improper restriction of operations within memory buffers in Cisco Secure Workload could allow buffer overflows and out-of-bounds writes. CVSS score 7.5, fixed…
Check Point Research has disclosed a technique that abuses Microsoft Defender's own legitimately signed boot-time remediation driver, BTR.sys, to perform arbitrary kernel-level…
The U.S. government has issued a joint advisory warning of an active threat targeting critical infrastructure organizations using AI-generated exploit scripts. The…
Adversa AI has disclosed a novel attack technique dubbed "Cryptographic Context Injection" that can cause xAI's Grok chatbot to exfiltrate a user's…
Researchers at the University of Massachusetts Amherst have demonstrated a novel attack, dubbed "Zombie Card," that can revive expired Visa contactless credit…
Cybersecurity researchers have disclosed two denial-of-service (DoS) attack techniques, collectively named "CDN Tsunami," that exploit how major content delivery networks (CDNs) convert…
In March 2026, Meta experienced a significant data exposure incident when an approved internal AI agent posted sensitive company and user data…
MarlboroMan is a threat actor who advertised RedC2 on Hack Forums and operates the Red Offsec website, selling the C2 framework for…
MoYu Group is a threat actor group attributed with high confidence to the BADBOX ad fraud and residential proxy scheme. They were…
FIN7 is a financially motivated cybercrime group that has been active since at least 2015. They are known for targeting the hospitality,…
Suspected Russian cyber espionage groups are abusing legitimate authentication flows, including Google OAuth and WhatsApp device linking, to hijack accounts across Europe…
RedShell is the Linux beacon component of RedC2 4.0, providing interactive shell access, system discovery, data collection, persistence, and network pivoting. It…
Cybersecurity researchers at Trend Micro's TrendAI have uncovered a set of 14 trojanized npm packages that masquerade as legitimate calendar and streak…
RedC2 is a cross-platform command-and-control framework for Windows, macOS, and Linux, marketed on cybercrime forums and sold via Red Offsec. It features…
JarService is a dropper used by MoYu Group to deliver malware to Android-based car head units. It launches a loader that communicates…
Researchers from UC Berkeley, the Ethereum Foundation, and NYU Shanghai presented a two-turn attack at USENIX Security 2026 that succeeded against Grok…
The Zombie Card attack was presented at the 35th USENIX Security Symposium held in Baltimore from August 12 to 14, 2026. The…
ISO/IEC 27001:2022 is an international information security management standard. Its Annex A includes access control and identity management controls that organizations can…
The GCIH certification demonstrates proficiency in incident handling and response, often pursued after SANS SEC504 training.
The SEC660 course at SANS Network Security 2026 teaches how to leverage AI for automating tasks while maintaining deep manual understanding of…
SANS SEC504 is a training course covering hacker tools, techniques, and incident handling, leading to GCIH certification.
RedC2 4.0 is the latest version of the RedC2 C2 framework, introducing the RedShell Linux beacon and AI-assisted Red Agent. It is…
Red Agent is an LLM-driven component of RedC2 that translates natural-language prompts into framework beacon commands, enabling operators to execute complex post-exploitation…
TWCore is a legitimate system app on DoFun head units that collects analytics and updates software via MQTT. Threat actors weaponized its…
BTR.sys is a legitimate signed driver used by Microsoft Defender to remove malware after a reboot. It is embedded in MpEngine.dll and…
DoFun is the manufacturer of Android-based automotive head unit firmware that was exploited by MoYu Group to distribute malware through built-in updaters.…
HUMAN Satori is the threat intelligence and research team that previously exposed the BADBOX ad fraud and residential proxy scheme, linking it…
SentinelLabs is the research arm of SentinelOne, a cybersecurity company. It focuses on vulnerability research, threat hunting, and the discovery of advanced…
Wazuh is an open-source security platform that provides SIEM and XDR capabilities. It offers AI-powered features like the Wazuh AI Analyst for…
Seven malicious Firefox extensions use threat actor-controlled Supabase projects to dynamically serve phishing or decoy content, abusing the platform's infrastructure.
The 37 sports-score shell extensions share a hard-coded credential for API-Sports, a legitimate sports data service, indicating coordinated infrastructure.
Fifteen malicious Firefox extensions exfiltrate wallet secrets through Cloudflare Workers, leveraging the service for data theft.
msaRAT uses Twilio TURN relays to establish WebRTC DataChannels between the browser and C2 server.