ServicesBlogPricingContactContact Now

Grivyonx Intelligence Hub

Cyber Security News and Analysis - Page 22

Zero-days, ransomware, data breaches and active exploitation, explained with practical defence advice.

Cyber Security

Iranian Cavern C2 Framework Evolves with DNS & Google Apps Script Stealth

Iranian state-sponsored actors continue refining the Cavern command-and-control framework, now leveraging DNS tunneling and Google Apps Script to mask malicious traffic as legitimate cloud activity. Kaspersky researchers have uncovered previously undocumented components that significantly expand the framework's stealth capabilities against Israeli targets. This evolution demonstrates a calculated shift toward living-off-the-land techniques that abuse trusted infrastructure, making detection substantially harder for conventional security controls.

By Gourav Rajput

Cyber Security

Evooo1Bot Elevates Mirai with Powerful New Modules

The newest iteration of the Mirai botnet, called Evooo1Bot, has been seen extending its reach with advanced exploitation tools and persistent command‑and‑control features. This update transforms infected devices into a broader attacker infrastructure, adding credential theft and reverse SOCKS relays. These enhancements mark a significant shift from traditional DDoS‑only tactics to a full‑stack malicious ecosystem.

By Gourav Rajput

Cyber Security

MCP Servers: Silent Enterprise Secret Leaks

MCP servers can unintentionally reveal sensitive corporate data through plaintext configuration files, overly permissive access rights, and subtle prompt‑injection attacks. These vulnerabilities often remain unnoticed until a breach occurs, creating hidden security gaps.

By Gourav Rajput

Cyber Security

Unisoc VoLTE Exploit: Full Android Kernel Access Risk

A critical security vulnerability has been identified in Unisoc modem firmware, allowing attackers to escalate privileges through a simple VoLTE video call. This exploit chain leads to full Android kernel access, posing a severe threat to device integrity.

By Gourav Rajput

Cyber Security

Evooo1Bot Linux Botnet Hijacks Edge Devices for SOCKS5 Proxies

Security researchers have uncovered a fresh Linux botnet family named Evooo1Bot, which builds on the publicly released Mirai source code to compromise internet‑facing devices. The malware not only retains Mirai’s DDoS engine but also expands its arsenal with advanced capabilities, allowing attackers to repurpose compromised hardware as SOCKS5 proxies. This evolution signals a shift toward more covert, proxy‑based attacks that can be leveraged for data theft, credential stuffing, and further botnet recruitment. The discovery underscores the urgent need for robust patch management and continuous monitoring of edge devices.

By Gourav Rajput

Cyber Security

China-Linked Hackers Exploit Critical VMware vCenter Flaw

Cybersecurity researchers have identified a sophisticated attack campaign exploiting a critical VMware vCenter vulnerability (CVE-2026-59310) linked to a China-nexus advanced persistent threat group. The vulnerability, which allows remote code execution, is being weaponized to deploy ransomware derived from the Babuk malware family. This analysis explores the technical details, threat actor tactics, and implications for enterprise security.

By Gourav Rajput

Cyber Security

Hackers Invest $7M in Expired Domains for Mass Malware Redirects

Threat actors have invested nearly $7 million acquiring expired domains during the first half of 2026, weaponizing the residual traffic and reputation of abandoned web properties to funnel unsuspecting visitors toward scams and malware. DNS intelligence firm Infoblox has termed these "dropcatch domains" and documented over 50,400 such acquisitions in just six months.

By Gourav Rajput

Cyber Security

Mustang Panda Deploys Signed Kernel Rootkit in CoolClient Backdoor

A notorious advanced persistent threat group linked to China, Mustang Panda (also tracked as HoneyMyte), has upgraded its CoolClient backdoor with a digitally signed Windows kernel-mode rootkit. This new capability allows deeper system infiltration and evasion techniques targeting government and military entities in Southeast Asia and Central Asia.

By Gourav Rajput

Cyber Security

DecryptAds: Unmasking Your Digital Trackers

A new free service called DecryptAds is making it easier than ever to uncover which companies are tracking your online behavior. By scraping and correlating publicly available adtech data, the tool provides transparency into the complex ecosystem of digital advertising and data collection that follows users across websites and mobile applications.

By Gourav Rajput

Cyber Security

RecruitTrap: 3,000+ Phishing Sites Target Google & Facebook

CTM360’s latest research uncovers a sprawling recruitment‑themed phishing scheme that lures users into fake interview pages and uses in‑browser capture to siphon Google and Facebook credentials. The attack even relays multi‑factor authentication prompts in real time, making it harder for victims to detect the breach.

By Gourav Rajput

Cyber Security

Apple Expands Global Cybersecurity Alerts Amid Rising Spyware Threats

Apple has issued fresh security notifications to users across 110 countries, flagging potential mercenary spyware threats. This marks an escalation in the company's efforts to safeguard users globally, with over 150 nations now warned since late 2021. The increase underscores growing concerns about sophisticated cyber-espionage targeting mobile devices.

By Gourav Rajput

Cyber Security

Critical VMware vCenter Exploit: Patching May Not Be Enough

A global cyber threat campaign is actively exploiting a critical flaw in VMware vCenter Server (CVE-2026-59310). While patching is essential, experts warn that it may not fully neutralize the risk. Organizations must adopt layered defenses to counter this evolving threat.

By Gourav Rajput

Cyber Security

GeoServer Zero-Day Under Active Attack, RCE Risk Looms

Security researchers have uncovered an unpatched SQL injection flaw in GeoServer that attackers are already exploiting to achieve remote code execution. The vulnerability, disclosed on August 12, 2026, remains without a CVE identifier, leaving many organizations exposed. Immediate defensive measures are essential to mitigate the risk.

By Gourav Rajput

Cyber Security

City-Forum Campaign Hits Salesforce, ServiceNow Since 2025

The City‑Forum operation, active since early 2025, has quietly compromised organizations that depend on Salesforce and ServiceNow platforms. Using custom‑built tooling, the campaign extracts credentials and sensitive records across multiple sectors while evading typical security controls.

By Gourav Rajput