Login Subscribe

Vulnerabilities & Exploits

Conpet Oil Pipeline Outage Shows Energy Sector’s Growing Cyber Vulnerability

Conpet Oil Pipeline Outage Shows Energy Sector’s Growing Cyber Vulnerability

On February 9, Check Point’s Threat Intelligence Report revealed that threat actors breached the IT environment of Conpet, Romania’s national oil pipeline operator. The attackers gained access to corporate services, manipulated DNS records and took the company’s public website offline. While the incident did not directly affect

Amaranth‑Dragon weaponizes CVE‑2025‑8088 against SE Asia critical infrastructure

Amaranth‑Dragon weaponizes CVE‑2025‑8088 against SE Asia critical infrastructure

Checkpoint’s threat‑intelligence team has linked the state‑aligned group Amaranth‑Dragon to active exploitation of the newly disclosed CVE‑2025‑8088. The actors deployed a custom exploit chain that leverages the vulnerability to gain initial foothold on targeted networks, then installed bespoke persistence modules and anti‑forensic tools

Shadow Campaigns Expose Global Espionage Exploiting SAP and Exchange Flaws

Shadow Campaigns Expose Global Espionage Exploiting SAP and Exchange Flaws

Unit42’s “Shadow Campaigns” report uncovers a coordinated espionage effort that has compromised organizations worldwide by chaining together a variety of known vulnerabilities. Attackers leveraged privilege‑escalation flaws in SAP systems and remote code execution bugs in Microsoft Exchange to gain footholds, move laterally, and exfiltrate sensitive data. The campaign’

PDFs Weaponized to Drop Remote Access Trojan via Malicious JavaScript

PDFs Weaponized to Drop Remote Access Trojan via Malicious JavaScript

Security researchers observed a new phishing campaign that distributes seemingly benign PDF documents. When opened, the PDFs execute embedded JavaScript that silently contacts a malicious server, downloads a payload, and installs a remote‑access trojan (RAT) on the victim’s machine. The infection chain leverages legitimate PDF reader features, bypasses

vDefend Extends Zero‑Trust Automation to VMware Private Clouds

vDefend Extends Zero‑Trust Automation to VMware Private Clouds

VMware’s security team unveiled vDefend, a solution that embeds zero‑trust principles directly into private cloud workloads. By automating policy creation, continuous compliance checks, and real‑time threat detection, vDefend enforces least‑privilege access across VMs, containers, and Kubernetes clusters without manual rule‑writing. The blog details the architecture,

CISA Flags Common Open‑Source Tools Fueling Global Attacks

The Cybersecurity and Infrastructure Security Agency (CISA) just issued an advisory that catalogs dozens of publicly available utilities—such as remote access frameworks, credential‑dumping scripts, and network‑mapping scanners—that have repeatedly shown up in high‑profile breaches across continents. By aggregating data from incident reports, vendor disclosures, and

APT36 Exploits ISO Attachments to Deploy Crimson RAT in Indian Startups

APT36 Exploits ISO Attachments to Deploy Crimson RAT in Indian Startups

Pakistan‑aligned APT36 has shifted its focus to India’s fast‑growing startup ecosystem. The group is delivering spear‑phishing emails that contain ISO‑based attachments. When opened, the ISO automatically extracts a malicious Windows shortcut (LNK) which executes a payload that installs the Crimson Remote Access Tool. Crimson RAT

Amaranth‑Dragon exploits fresh CVE‑2025‑8088 to infiltrate SE Asian critical infrastructure

Amaranth‑Dragon exploits fresh CVE‑2025‑8088 to infiltrate SE Asian critical infrastructure

Check Point’s threat‑intel team has identified a new campaign by the Amaranth‑Dragon group that leverages the just‑released CVE‑2025‑8088 vulnerability in widely deployed network appliances. The zero‑day allows remote code execution, which the actors use to install a custom backdoor and move laterally across