Grivyonx Intelligence Hub
Zero-days, ransomware, data breaches and active exploitation, explained with practical defence advice.
The Democratic People's Republic of Korea is leveraging low‑tech phishing schemes to pry open Ukrainian communications, seeking insights into its own involvement in the ongoing conflict. This covert campaign illustrates how state actors exploit simple social‑engineering tactics to gather strategic intelligence.
By Gourav Rajput
Security researchers have identified a critical attack chain involving three zero-day vulnerabilities in Ivanti Connect Secure, a widely used VPN solution. While two flaws have been patched, one remains unpatched, allowing attackers to gain root-level system access. Volexity, the firm that uncovered the vulnerabilities, emphasizes the urgency of mitigating the remaining risk.
By Gourav Rajput
Security researchers have disclosed a critical vulnerability chain affecting LG Smart TVs running webOS 7.5.7-25. The flaw allows an attacker on the same local network to achieve root-level control without any user interaction or PIN entry. LG has since issued patches addressing the three chained vulnerabilities.
By Gourav Rajput
On the night of October 11, attackers remotely seized control of refrigeration units across hundreds of French supermarkets, raising internal temperatures to as high as 50°C. The breach, which exploited a Danfoss controller, forced stores to discard perishable stock, highlighting a critical gap in IoT security for the retail sector. The incident underscores the need for robust authentication, regular patching, and network segmentation to protect essential supply‑chain equipment.
By Gourav Rajput
Progress Software has disclosed 31 vulnerabilities in MarkLogic Server, including two critical flaws that allow delegated managers to escalate privileges and gain persistent administrative control. Patches have been available since September 10 in versions 11.3.7 and 12.1.0. Organizations using MarkLogic should prioritize immediate updates to prevent potential compromise of sensitive enterprise data.
By Gourav Rajput
GitLab has released emergency security updates to address a maximum-severity vulnerability tracked as CVE-2024-6678. This flaw, scoring a perfect 10.0 on the CVSS scale, allows unauthenticated attackers to execute arbitrary code on the server by exploiting a weakness in how CI/CD configuration processes regular expressions. Organizations running GitLab Community or Enterprise Editions must prioritize immediate patching to prevent potential server compromise and supply chain contamination.
By Gourav Rajput
A prominent figure in the ransomware negotiation world has been arrested on federal extortion conspiracy charges, sending shockwaves through the cybersecurity community. Edward Dubrovsky, long considered a go-to expert for organizations held hostage by cybercriminals, now stands accused of crossing the line between negotiator and co-conspirator. The case raises urgent questions about oversight in the incident response industry and the fragile trust underpinning cyber insurance claims.
By Gourav Rajput
Ledger has paused sales through reseller CryptoBilis after reports of stolen funds linked to its hardware wallets. An investigation uncovered an unauthorized hardware implant, raising concerns about supply chain integrity and user asset protection.
By Gourav Rajput
A sophisticated two‑pronged campaign targeting Ukrainian WordPress sites, e‑commerce platforms, and critical infrastructure has exposed more than 628,000 records. The attackers combined traditional offensive tools such as Cobalt Strike with an AI orchestration layer powered by Anthropic’s Claude Code, marking a new escalation in cyber‑espionage tactics.
By Gourav Rajput
Federal agents have taken the co-founder of a prominent Canadian cybersecurity company into custody as part of an expanding investigation into the notorious ShinyHunters hacking collective. The arrest marks a stunning reversal for a firm that positioned itself as a defender against the very threats its leadership allegedly enabled. The development sends shockwapers through the incident response community, raising urgent questions about vetting practices, conflict of interest, and the blurred lines between legitimate negotiation services and criminal facilitation in the ransomware ecosystem.
By Gourav Rajput
Cybersecurity researchers have uncovered an ongoing credential-theft campaign targeting GitHub repositories. By compromising high-profile open-source maintainer accounts, attackers injected malicious GitHub Actions workflows into more than 340 repositories, potentially exposing sensitive credentials and secrets stored within those projects.
By Gourav Rajput
Federal authorities have taken another step in the ongoing investigation of the ShinyHunters extortion group, arresting a suspected co‑conspirator linked to the breach of the FBI’s jobs portal. While the bureau has not disclosed the individual’s name or formal charges, the development underscores the persistent threat posed by sophisticated cyber‑criminal collectives targeting government systems.
By Gourav Rajput
Security researchers at iVerify have uncovered P7 DarkSword, a stealthier evolution of the DarkSword iOS exploit framework. This variant shrinks its device footprint while adding dangerous new capabilities: direct theft of keychain credentials and cryptocurrency wallet data, plus full two-way command-and-control communication. The discovery signals a shift toward financially motivated, persistent mobile espionage.
By Gourav Rajput
Cybercriminals increasingly target executives' families as the path of least resistance into corporate networks. This article explores why family members represent a critical security blind spot and how structured training programs can transform them from vulnerabilities into active defenders.
By Gourav Rajput
A wave of legal action has hit TP‑Link, with five U.S. states now alleging that the California‑based router maker misled buyers about the security of its products and the extent of its connections to China. The complaints, filed in Texas, Florida, Iowa, Montana and Nebraska, claim deceptive marketing practices that downplay potential vulnerabilities, while TP‑Link maintains the accusations are unfounded and vows to contest each claim in court.
By Gourav Rajput
Threat actors have been observed leveraging recently disclosed weaknesses in the AhsayCBS backup solution to take over vulnerable machines. By exploiting an authentication bypass, they inject web shells and covert cryptocurrency miners, often masquerading as legitimate software like Microsoft Edge. The incident highlights how backup utilities—often considered low‑risk—can become entry points for sophisticated attacks.
By Gourav Rajput
Sophos has achieved a 96% reduction in threat investigation time by integrating OpenAI's Daybreak into its managed detection and response operations. The AI-driven approach automates over half of all MDR cases while maintaining critical human oversight, setting a new benchmark for security operations efficiency.
By Gourav Rajput
In a coordinated operation, the FBI and Department of Justice have seized seven domains linked to Flax Typhoon, a China-backed advanced persistent threat group. The takedown disrupts malicious tooling used to scan and infiltrate US critical infrastructure, marking a significant win for defensive cyber operations. The disruption targets infrastructure supporting the group's custom malware framework, which enabled persistent access to compromised networks across telecommunications, energy, and government sectors. This action signals a shift toward proactive dismantling of adversary capabilities rather than purely reactive defense.
By Gourav Rajput
