ServicesBlogPricingContactContact Now

Grivyonx Intelligence Hub

Cyber Security News and Analysis - Page 30

Zero-days, ransomware, data breaches and active exploitation, explained with practical defence advice.

Cyber Security

Russian Spies Infiltrate IP Cameras to Track NATO & Ukraine Movements

Dutch civilian and military intelligence agencies have uncovered a coordinated effort by at least one Russian intelligence service to hijack internet‑connected security cameras across Europe and Ukraine. The operation provides Moscow with real‑time views of military transport corridors, weapons shipments bound for Kyiv, and the positioning of Ukrainian forces. This clandestine surveillance network highlights a growing vulnerability in everyday IoT devices and raises urgent questions about the security of critical infrastructure in NATO‑aligned nations.

By Gourav Rajput

Cyber Security

Mythos Exposes New Security Gap

Anthropic’s Mythos AI has flooded the security landscape with a surge of newly identified CVEs, yet the real danger lies beyond sheer volume. The threat is the exposure window that opens before defenders can triage and remediate these vulnerabilities. Understanding and managing this window is essential for modern security programs.

By Gourav Rajput

Cyber Security

Critical 7-Zip Vulnerability: Protecting Your Data

A significant security flaw has been identified in the popular archiving tool 7-Zip. The vulnerability, identified as CVE-2026-14266, could allow attackers to execute malicious code on a user's system through specifically crafted XZ files.

By Gourav Rajput

Cyber Security

Russian Hacker Leverages Gemini CLI to Hijack Dental Clinic Botnet

A lone Russian‑speaking actor, calling themselves "bandcampro," outsourced part of their operation to Google’s open‑source Gemini CLI. By exploiting AI capabilities, they cracked passwords and assembled a live botnet comprising eight computers from dental clinics. The incident, uncovered through 200 Gemini CLI session logs spanning March–19 to April–21, 2026, illustrates how readily available AI tools can be repurposed for malicious ends, targeting niche sectors like healthcare.

By Gourav Rajput

Cyber Security

SleeperGem: Three Malicious RubyGems Hit Developer Machines

A fresh supply‑chain threat named SleeperGem has been exposed, targeting Ruby developers through three malicious gems published on RubyGems. These rogue packages, released in July 2026, pose a serious risk to developer environments by potentially delivering additional payloads and compromising build workflows. The discovery highlights the growing sophistication of attacks aimed at the software development lifecycle.

By Gourav Rajput

Cyber Security

Nginx Flaw Allows Worker Crash & Remote Code Execution

A newly disclosed heap buffer overflow in the NGINX worker process can be triggered by malicious HTTP traffic, leading to crashes or restarts. The flaw, tracked as CVE‑2026‑42533, has been addressed in recent stable and mainline releases, urging anyone on older builds to apply the updates immediately.

By Gourav Rajput

Cyber Security

ClickFix CAPTCHA Attack: UAC‑0145 Hijacks Ukrainian Devices

Russian state‑sponsored actors have once again turned to social engineering, this time deploying ClickFix CAPTCHA tricks to lure Ukrainian users into installing malicious software. The operation, attributed to the UAC‑0145 sub‑cluster within Sandworm, showcases the evolving tactics of geopolitical cyber‑attackers and underscores the need for heightened cyber hygiene and robust defense mechanisms.

By Gourav Rajput

Cyber Security

SonicWall SMA Zero-Day Flaws Exploited Pre-Disclosure by Unknown Hacker Group

Security researchers at Volexity have identified a previously unknown hacking group exploiting critical vulnerabilities in SonicWall Secure Mobile Access appliances months before these flaws were publicly acknowledged. The campaign, tracked under the alias UTA0533, represents a significant concern for organizations relying on these VPN solutions.

By Gourav Rajput

Cyber Security

Inc Ransomware Chains SonicWall Zero-Days for Root Access

Threat actors behind Inc Ransomware have been observed chaining two critical zero-day vulnerabilities in SonicWall Secure Mobile Access (SMA) appliances. This exploit chain grants attackers unauthenticated root-level access, bypassing authentication entirely. Organizations running affected firmware versions face immediate risk of network compromise, data exfiltration, and ransomware deployment.

By Gourav Rajput

Cyber Security

ViteVenom: 7 Malicious npm Packages Exploit Blockchain C2

Security researchers have uncovered a coordinated campaign dubbed ViteVenom, where seven booby‑trapped npm packages masquerade as legitimate Vite tooling. The attack leverages a novel four‑tier blockchain command‑and‑control infrastructure to silently install a remote access trojan on developer machines. This incident highlights the growing sophistication of software supply chain threats targeting frontend ecosystems.

By Gourav Rajput

Cyber Security

GoldenEyeDog Linked to DigiCert Code‑Signing Theft

Researchers have linked the April 2026 DigiCert breach to the GoldenEyeDog subgroup, identified as CylindricalCanine, a sub‑group of a Chinese cyber‑crime collective. Technical analysis shows the stolen code‑signing certificates were used to sign malicious payloads, underscoring supply‑chain vulnerabilities.

By Gourav Rajput

Cyber Security

North Korean Actors Hide Malware in SVG ‘Job Test’ Images

North Korean threat actors are exploiting fake coding challenges to distribute malware hidden inside SVG flag images. By embedding a four‑stage payload chain aligned with the OTTERCOOKIE framework, they target both credentials and sensitive files. This article explores the attack mechanics, steganographic techniques, payload architecture, and practical countermeasures for organizations and individuals.

By Gourav Rajput

Cyber Security

GoSerpent Malware Targets Southeast Asian Governments

Security researchers have identified a new malware strain called GoSerpent that has been active against government and diplomatic entities across Southeast Asia since late 2025. The threat, uncovered by Kaspersky in February 2026, focuses on establishing persistent, low‑profile access to gather intelligence over extended periods.

By Gourav Rajput

Cyber Security

CISA Adds SharePoint Zero-Day CVE‑2026‑58644 to KEV

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a newly patched Microsoft SharePoint Server vulnerability to its Known Exploited Vulnerabilities (KEV) list. This critical deserialization flaw, identified as CVE‑2026‑58644 with a CVSS score of 9.8, poses a severe remote code execution risk. Federal Civilian Executive Branch agencies are required to apply the security fix by July 19, 2026, to remain compliant with the agency’s mandate.

By Gourav Rajput

Cyber Security

Teen Scattered Spider Duo Jailed for TfL Breach

An 18-year-old and a 20-year-old linked to the Scattered Spider collective have been imprisoned for their roles in a devastating 2024 intrusion at Transport for London. The operation paralyzed 148 systems and triggered an unprecedented in-person password reset for thousands of staff. Courts handed down matching 5.5-year terms following an extensive investigation by UK authorities.

By Gourav Rajput

Cyber Security

Weekly Threat Roundup: Game Cheat Spyware, Rapid Ransomware & Chrome Sync Risks

This week's threat landscape reveals a disturbing pattern: legitimate-looking tools and familiar settings weaponized against users. From game cheats hiding spyware to ransomware operators compressing attack timelines to 24 hours, defenders face accelerating threats. Chrome's sync feature emerges as an unexpected stalking vector, while old vulnerabilities resurface with new potency.

By Gourav Rajput

Cyber Security

n8n Authentication Vulnerability Exposes User Accounts to Cross-Issuer Attacks

A newly discovered security vulnerability in n8n's Enterprise platform could allow unauthorized access to user accounts through improper JWT token validation. The flaw occurs when multiple external token issuers are trusted, enabling cross-issuer impersonation attacks. Organizations using n8n's Enterprise edition with multi-issuer configurations are at risk of having their user accounts compromised by malicious actors exploiting this weakness.

By Gourav Rajput