Forwarded from ᴛʜᴇ ɢʜᴏꜱᴛ ɪɴ ᴛʜᴇ ᴍᴀᴄʜɪɴᴇ
A significant cyberattack against Israeli government servers and the gov.il system was thwarted early on March 11. The attack, a DDoS (Denial of Service) type, aimed to disable websites by flooding them with excessive traffic and crashing them.
@TheGhostITM
@TheGhostITM
Forwarded from ᴛʜᴇ ɢʜᴏꜱᴛ ɪɴ ᴛʜᴇ ᴍᴀᴄʜɪɴᴇ
תקיפת סייבר משמעותית נגד שרתי ממשלת ישראל ומערכת gov.il חוסמה מוקדם ב-11 במרץ.
התקיפה, מסוג DDoS (Denial of Service), נועדה להשבית אתרים על ידי הצפתם בתעבורה מופרזת וגרימת קריסתם.
@TheGhostITM
התקיפה, מסוג DDoS (Denial of Service), נועדה להשבית אתרים על ידי הצפתם בתעבורה מופרזת וגרימת קריסתם.
@TheGhostITM
Forwarded from ᴛʜᴇ ɢʜᴏꜱᴛ ɪɴ ᴛʜᴇ ᴍᴀᴄʜɪɴᴇ
מרכבת ישראל נמסר לתקשורת:
"נרשמו שיבושים בפעילות שלטי הפרסום והמידע באולמות הנוסעים בתחנות רכבת בודדות, הופסקה זמנית פעילות השלטים.
@TheGhostITM
"נרשמו שיבושים בפעילות שלטי הפרסום והמידע באולמות הנוסעים בתחנות רכבת בודדות, הופסקה זמנית פעילות השלטים.
@TheGhostITM
Forwarded from ᴛʜᴇ ɢʜᴏꜱᴛ ɪɴ ᴛʜᴇ ᴍᴀᴄʜɪɴᴇ
International media outlets, including NBC News, have reported on a cyberattack carried out by the Handala group against U.S.-based medical technology company Stryker.
The attackers gained access to Microsoft Intune, a platform used by organizations to manage and secure corporate devices. After compromising the system, the hackers triggered the platform’s remote wipe capability, resetting a large number of employee mobile devices to factory settings.
The incident disrupted internal communications across the company and significantly impacted day‑to‑day operations.
The attackers appear to have abused Intune’s legitimate device management features—particularly the remote wipe function—to erase data from affected devices and force system resets.
@TheGhostITM
The attackers gained access to Microsoft Intune, a platform used by organizations to manage and secure corporate devices. After compromising the system, the hackers triggered the platform’s remote wipe capability, resetting a large number of employee mobile devices to factory settings.
The incident disrupted internal communications across the company and significantly impacted day‑to‑day operations.
The attackers appear to have abused Intune’s legitimate device management features—particularly the remote wipe function—to erase data from affected devices and force system resets.
@TheGhostITM
A Distributed Denial of Service (DDoS) attack has disrupted access to Qatar University's online portal.
CISA confirms active exploitation of CVE-2025-68613 in the #n8n automation platform.
The expression-injection flaw allows authenticated attackers to run code with n8n process privileges—exposing data, altering workflows, or taking full control of the instance.
The expression-injection flaw allows authenticated attackers to run code with n8n process privileges—exposing data, altering workflows, or taking full control of the instance.
Apple backports CVE-2023-43010 fix after the WebKit flaw was used in the Coruna #iPhone exploit kit.
It allows memory corruption via malicious web content. Fix now covers iOS 15.8.7 & 16.7.15 devices, including iPhone 6s, 7, 8 & X.
It allows memory corruption via malicious web content. Fix now covers iOS 15.8.7 & 16.7.15 devices, including iPhone 6s, 7, 8 & X.
Attackers now weaponize phishing volume.
Research shows 66% of SOC teams can’t keep up with alerts, letting attackers hide targeted spear-phish inside thousands of decoys. The flood isn’t random. It’s meant to exhaust analysts and slow investigation.
Research shows 66% of SOC teams can’t keep up with alerts, letting attackers hide targeted spear-phish inside thousands of decoys. The flood isn’t random. It’s meant to exhaust analysts and slow investigation.
Modern phishing now hides behind HTTPS and trusted services, so attacks look like normal logins.
Sandbox analysis executes suspicious links safely and exposes credential-stealing flows in under 60 seconds.
Sandbox analysis executes suspicious links safely and exposes credential-stealing flows in under 60 seconds.
IBM X-Force found AI-generated #malware Slopoly used by Hive0163.
The PowerShell backdoor persists for days, beacons every 30s, and runs commands from a remote C2. AI didn’t make it advanced — it made malware faster to build.
The PowerShell backdoor persists for days, beacons every 30s, and runs commands from a remote C2. AI didn’t make it advanced — it made malware faster to build.
Rust-based banking trojan VENON is targeting 33 financial institutions in Brazil.
It monitors banking windows, triggers credential-stealing overlays, and hijacks Itaú app shortcuts to redirect victims to attacker-controlled pages.
It monitors banking windows, triggers credential-stealing overlays, and hijacks Itaú app shortcuts to redirect victims to attacker-controlled pages.
Veeam fixed multiple flaws in Backup & Replication, including 9.9-severity RCE bugs that let authenticated domain users run code on backup servers.
Affected: all v12 builds before 12.3.2.4465.
Affected: all v12 builds before 12.3.2.4465.
Global police dismantled SocksEscort, a proxy botnet built from hacked home routers.
AVrecon malware turned SOHO devices into anonymous gateways for fraud, ransomware, and DDoS.
Operation Lightning seized 34 domains, 23 servers, froze $3.5M. 369K IPs across 163 countries.
AVrecon malware turned SOHO devices into anonymous gateways for fraud, ransomware, and DDoS.
Operation Lightning seized 34 domains, 23 servers, froze $3.5M. 369K IPs across 163 countries.
Forwarded from ᴛʜᴇ ɢʜᴏꜱᴛ ɪɴ ᴛʜᴇ ᴍᴀᴄʜɪɴᴇ
Forwarded from ᴛʜᴇ ɢʜᴏꜱᴛ ɪɴ ᴛʜᴇ ᴍᴀᴄʜɪɴᴇ
Forwarded from ᴛʜᴇ ɢʜᴏꜱᴛ ɪɴ ᴛʜᴇ ᴍᴀᴄʜɪɴᴇ
Handala Hack: Zimmet's 50K Emails Expose Mossad Funds & Reza Pahlavi Projects
Pro-Palestinian Handala infiltrated Raz Zimmet's (Israel Iran desk head) systems, accessing 50K+ confidential emails. Reveals $300K/mo Mossad budget + joint Israeli-Pahlavi destabilization plans vs Iran. [Handala Team]
@TheGhostITM
Pro-Palestinian Handala infiltrated Raz Zimmet's (Israel Iran desk head) systems, accessing 50K+ confidential emails. Reveals $300K/mo Mossad budget + joint Israeli-Pahlavi destabilization plans vs Iran. [Handala Team]
@TheGhostITM
Forwarded from ᴛʜᴇ ɢʜᴏꜱᴛ ɪɴ ᴛʜᴇ ᴍᴀᴄʜɪɴᴇ
האקרים מחמאס משתלטים על אוניברסיטת העברית ביום קודס
(huji.ac.il)
קבוצת האקרים פרו-פלסטינית של חמאס טוענת למתקפת סייבר מתוחכמת על תשתיות אוניברסיטת העברית בירושלים, שמשביתה מרכז מדעי ציוני מרכזי.
#מלחמת_סייבר #יום_קודס #Handala
@TheGhostITM
(huji.ac.il)
קבוצת האקרים פרו-פלסטינית של חמאס טוענת למתקפת סייבר מתוחכמת על תשתיות אוניברסיטת העברית בירושלים, שמשביתה מרכז מדעי ציוני מרכזי.
#מלחמת_סייבר #יום_קודס #Handala
@TheGhostITM
Meta will shut down Instagram’s end-to-end encrypted chats on May 8, 2026.
Users with affected conversations will get instructions to download messages or media before the change.
Users with affected conversations will get instructions to download messages or media before the change.
Researchers exposed a long-running cyber espionage campaign targeting Southeast Asian militaries.
The cluster CL-STA-1087 deployed AppleChris and MemFun backdoors plus a custom Mimikatz variant to quietly extract data on C4I systems, military capabilities, and Western defense ties.
The cluster CL-STA-1087 deployed AppleChris and MemFun backdoors plus a custom Mimikatz variant to quietly extract data on C4I systems, military capabilities, and Western defense ties.
INTERPOL dismantled 45,000 malicious IPs and servers tied to phishing, malware, and ransomware.
Operation Synergia III across 72 countries led to 94 arrests, 110 suspects under investigation, and seized devices and servers tied to global scam infrastructure.
Operation Synergia III across 72 countries led to 94 arrests, 110 suspects under investigation, and seized devices and servers tied to global scam infrastructure.
Microsoft says attackers are poisoning search results to spread fake VPN clients that steal credentials.
The campaign redirects software searches to trojanized installers on GitHub that show fake VPN prompts while Hyrax steals credentials.
The campaign redirects software searches to trojanized installers on GitHub that show fake VPN prompts while Hyrax steals credentials.