CISA Adds Two Known Exploited Vulnerabilities to Catalog CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. - CVE-2023-4346 KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability - CVE-2026-46817 Oracle E-Business Suite Improper Privilege Management Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied. While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria. Aware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA’s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance. This product is provided subject to this Notification and this Privacy & Use policy.
Jul 16, 2026 · via cisa.gov
Open a repository in Cursor on Windows and, if a file named git.exe is sitting in the project root, Cursor runs it. No click, no approval dialog, no warning that anything in the folder is about to execute. Whatever that binary does, it does as you, with your source, your SSH keys and your cloud tokens. Cursor keeps re-running it for as long as the project stays open. No prompt injection, no agent, no model in the loop, and no prior access to the machine: opening the folder is the entire exploit, and the result is arbitrary code execution as the logged-in user. AI security firm Mindgard reported the flaw to Cursor on December 15, 2025 and published full technical details on Tuesday, seven months later. There is still no patch, and Cursor has published no advisory for the issue. The mechanism takes about a sentence. Cursor checks several locations for a Git binary when a project loads, and one of them is the workspace itself. Process Monitor output in the write-up shows Cursor.exe spawning the repo-root binary with the command line git rev-parse --show-toplevel. That is the same repository-root probe Microsoft's VS Code docs describe. Whether Cursor searches those locations itself or hands Windows an unqualified git and lets the search order pick, the write-up does not say. Mindgard's proof of concept was Windows Calculator, renamed git.exe, and committed to the root. Clone, open, done. The screenshot shows Calculator windows stacking up on their own while the project sat open. The precondition sounds like the hard part: an attacker's binary, sitting in your project root. It is not. Cloning a stranger's repository is how binaries land on disk in the first place, and developers and their agents do it all day. The attacker needs no foothold to begin with.
Jul 16, 2026 · via thehackernews.com
Country United States of America US Virgin Islands United States Minor Outlying Islands Canada Mexico, United Mexican States Bahamas, Commonwealth of the Cuba, Republic of Dominican Republic Haiti, Republic of Jamaica Afghanistan Albania, People's Socialist Republic of Algeria, People's Democratic Republic of American Samoa Andorra, Principality of Angola, Republic of Anguilla Antarctica (the territory South of 60 deg S) Antigua and Barbuda Argentina, Argentine Republic Armenia Aruba Australia, Commonwealth of Austria, Republic of Azerbaijan, Republic of Bahrain, Kingdom of Bangladesh, People's Republic of Barbados Belarus Belgium, Kingdom of Belize Benin, People's Republic of Bermuda Bhutan, Kingdom of Bolivia, Republic of Bosnia and Herzegovina Botswana, Republic of Bouvet Island (Bouvetoya) Brazil, Federative Republic of British Indian Ocean Territory (Chagos Archipelago) British Virgin Islands Brunei Darussalam Bulgaria, People's Republic of Burkina Faso Burundi, Republic of Cambodia, Kingdom of Cameroon, United Republic of Cape Verde, Republic of Cayman Islands Central African Republic Chad, Republic of Chile, Republic of China, People's Republic of Christmas Island Cocos (Keeling) Islands Colombia, Republic of Comoros, Union of the Congo, Democratic Republic of Congo, People's Republic of Cook Islands Costa Rica, Republic of Cote D'Ivoire, Ivory Coast, Republic of the Cyprus, Republic of Czech Republic Denmark, Kingdom of Djibouti, Republic of Dominica, Commonwealth of Ecuador, Republic of Egypt, Arab Republic of El Salvador, Republic of Equatorial Guinea, Republic of Eritrea Estonia Ethiopia Faeroe Islands Falkland Islands (Malvinas) Fiji, Republic of the Fiji Islands Finland, Republic of France, French Republic French Guiana French Polynesia French Southern Territories Gabon, Gabonese Republic Gambia, Republic of the Georgia Germany Ghana, Republic of Gibraltar Greece, Hellenic Republic Greenland Grenada Guadaloupe Guam Guatemala, Republic of Guinea, Revolutionary People's Rep'c of Guinea-Bissau, Republic of Guyana, Republic of Heard and McDonald Islands Holy See (Vatican City State) Honduras, Republic of Hong Kong, Special Administrative Region of
Jul 16, 2026 · via madison.com
The government has revised its guidelines for artificial intelligence-related policies, calling for constantly strengthening measures against cyberattacks in light of serious risks posed by cutting-edge AI models. The original AI policy guidelines were compiled only last December. The revision comes amid rapid technological innovation, including the launch of U.S. startup Anthropic’s Claude Mythos. The revised guidelines, adopted at a Cabinet meeting on Tuesday, note the growing threat of cyberattacks against the backdrop of advancing AI capabilities, and call for collaborating with foreign government agencies and AI development companies to significantly strengthen the capabilities of Japan’s AI Safety Institute. The guidelines also highlight the need to avoid excessive reliance on specific countries or companies for AI, and express the government’s intention to develop domestic AI that addresses challenges facing Japan. Additionally, the guidelines emphasize the significance of vertical AI, which specializes in specific areas, and physical AI, which controls robots, and include plans to promote efforts to review operations under the assumption of AI. In light of structural changes in society, the guidelines call for continuing to study the division of roles between humans and AI and developing an educational environment that prevents a decline in human capabilities due to reliance on AI. With your current subscription plan you can comment on stories. However, before writing your first comment, please create a display name in the Profile section of your subscriber account page.
Jul 16, 2026 · via japantimes.co.jp
Australia and India are set to be more prescriptive and streamlined in their joint cyber initiatives through a new partnership launched last week. On 9 July, the two countries unveiled the Partnership on Cyber, Critical Technologies and Supply Chains (PACTS), which will streamline cyber dialogues and working groups to remove duplication. Replacing the 2020 framework, PACTS aims to counter cybercrime, deter malicious cyber activities and ultimately bolster cyber trade and capacity building. It will also establish practical workshops and a cyber skill incubator hub. The partnership is intended to be more prescriptive than its predecessor, with clearer announcements. PACTS is India’s latest security tech partnership, following the TRUST initiative with the United States and the Technology Security Initiative with Britain. It promises top-level synergy with Australia to deliver outcomes. Firstly, PACTS aims to consolidate and rationalise the bilateral mechanism in cybersecurity, removing duplication across working groups and dialogues. Since 2014, there have been five rounds of cyber policy dialogues led by India’s External Affairs Ministry (MEA) and Australia’s Department of Foreign Trade (DFAT), as well as the 2022 India-Australia Foreign Ministers’ Cyber Framework Dialogue. The countries have also held two joint working groups since 2020, one on information and communications technology and the other on cybersecurity cooperation. Under PACTS, cyber dialogues and working groups will still be led by MEA and DFAT but overseen by the deputy national security adviser of the National Security Council Secretariat (NSCS) in India and the deputy secretary of the International and Security Group within the Department of Prime Minister and Cabinet (PM&C) in Australia. They will provide strategic oversight and hold annual review meetings to track progress. India’s NSCS is well positioned to oversee this partnership, following the 2024 Allocation of Business Rules amendment which made it responsible for overall coordination and strategic direction
Jul 16, 2026 · via aspistrategist.org.au
In light of the recent guidance issued by the Securities and Futures Commission (SFC) in June 2026, we would like to share a strategic action plan tailored to help your organisation align with the evolving cybersecurity expectations and address the growing risks posed by AI-enabled threats.
The SFC has emphasised the urgent need for licensed firms to reassess and strengthen their cybersecurity controls, particularly in the areas of patching, access management, threat detection, third-party oversight, and incident response. With the rise in sophisticated cyber incidents — including hyper-personalised phishing, deepfake attacks, and AI-driven reconnaissance — traditional security approaches are no longer sufficient. A shift toward continuous, data-centric, and AI-enhanced defences is now essential.
KPMG is well-positioned to support your organisation throughout this journey. Our team offers a range of services, including cybersecurity gap assessments, continuous monitoring, incident response planning, and third-party risk governance, all aligned with the latest regulatory expectations and industry best practices.
Should you wish to discuss how we can tailor our support to your specific needs, please feel free to contact us directly. We remain committed to helping you navigate this evolving landscape with confidence and clarity.
Jul 16, 2026 · via kpmg.com
Mozilla has released updates to address two critical flaws in Firefox for which it warned that exploit code has been published. The vulnerabilities are listed below - - CVE-2026-15718, an invalid pointer in the JavaScript: WebAssembly component - CVE-2026-15719, a site isolation in the DOM: Navigation component "We are aware that exploit code for this is public, however we are not aware of any attacks in the wild abusing this flaw," Mozilla said in an advisory. Both vulnerabilities have been addressed in Firefox version 152.0.6. The release comes as Google shipped fixes for 15 security flaws, including two critical use-after-free bugs in Ozone (CVE-2026-15764 and CVE-2026-15765), a cross-platform abstraction layer that allows the browser to interact natively with various display servers and windowing systems. It supports Linux, ChromeOS, and Fuchsia. "Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page," according to a description of CVE-2026-15764 in the NIST National Vulnerability Database (NVD). The shortcomings have been patched in Chrome version 150.0.7871.124/.125 for Windows and Mac and 150.0.7871.124 for Linux. In a related development, Adobe has published security updates for 88 vulnerabilities, including multiple critical-severity bugs in ColdFusion, Commerce, Experience Manager, and Illustrator. Of these, eight impact Adobe ColdFusion - - CVE-2026-48318 (CVSS score: 9.9) - A path traversal vulnerability that could lead to arbitrary code execution - CVE-2026-48322 (CVSS score: 9.6) - A code injection vulnerability that could lead to arbitrary code execution - CVE-2026-48284 (CVSS score: 9.6) - An improper input validation vulnerability that could lead to arbitrary code execution - CVE-2026-48321 (CVSS score: 9.3) - An incorrect authorization vulnerability that could lead to privilege escalation - CVE-2026-48325 (CVSS score: 9.3)
Jul 16, 2026 · via thehackernews.com
Establishing a Coordinated Vulnerability Disclosure Program to Work With Security Researchers
Developed by CISA, the National Security Agency (NSA) and international partners, this joint guidance contains best practices for software manufacturers and online service providers to design and implement a coordinated vulnerability disclosure (CVD) program for working with external security researchers that includes a clear vulnerability disclosure policy (VDP) and process for triaging, remediating and assigning Common Vulnerabilities and Exposures (CVE) identifiers to reported vulnerabilities. The guidance also provides considerations for leveraging third-party intermediaries, like CISA or other national computer security incident response teams, to substitute or supplement a CVD program. By implementing a robust CVD program aligned with this guidance, organizations can work transparently and collaboratively with security researchers to remediate vulnerabilities, build constructive relationships, enhance product security while improving vulnerability management processes, and demonstrate their dedication to protecting customers.
Jul 16, 2026 · via cisa.gov
Important NEW Update Regarding P&A Group Cybersecurity Incident from NCFlex We have collaborated with P&A Group to address our concerns following the recent cybersecurity incident. At this time, we believe data transmission can safely resume. To protect sensitive information moving forward, several safeguards have been implemented. These include a web application firewall (WAF) to block malicious traffic, system hardening—which involves updating software and restricting access to minimize vulnerabilities—increased network segmentation to isolate critical systems, and an investigation into GovRAMP to ensure P&A Group's practices align with state policies for safeguarding sensitive data. Participant organizations are requested to coordinate with P&A Group regarding the transmission of delayed data feeds. The staff at P&A Group will prioritize processing these feeds. We want to thank all participant organizations for their patience and commitment throughout the remediation of this cybersecurity incident with P&A Group. We especially appreciate the prompt responses from participant organizations and the expert guidance provided by the NC Department of Information Technology Enterprise Security and Risk Management Office (ESRMO) and the NC Office of the State Controller during this process. Your understanding and cooperation have been invaluable. We remain dedicated to upholding rigorous cybersecurity standards and will continue to prioritize the safety of all participant data. Thank you again for your partnership. This article has the following tags: Human Resources Benefits
Jul 15, 2026 · via uncw.edu
MADISON, Wis.— TruStage Financial Group shut down its network due to a cybersecurity incident on Wednesday.
In a statement to News 3 Now spokesperson Barclay Pollak said the company activated its incident response and recovery efforts including shutting down the network. Additionally, cybersecurity experts are assisting with investigating, containing and remediating the incident, according to Pollak.
TruStage is an insurance provider based in Madison. The company said the investigation remains ongoing
COPYRIGHT 2026 BY CHANNEL 3000. ALL RIGHTS RESERVED. THIS MATERIAL MAY NOT BE PUBLISHED, BROADCAST, REWRITTEN OR REDISTRIBUTED.
Jul 15, 2026 · via channel3000.com
TruStage announces systems are down following cybersecurity incident
MADISON, Wis. (WMTV) - TruStage announced Wednesday that their systems were down following a cybersecurity incident.
According to a TruStage press release, the company found a cybersecurity incident affecting its environment and immediately activated its incident response and recovery protocols.
“Protecting the trust of the organizations and individuals TruStage serves is a core priority,” TruStage said in the release. “The company is approaching this matter responsibly and transparently, with a focus on supporting business partners, clients and other stakeholders while response efforts continue.”
TruStage is working to understand the facts and will provide updates when appropriate.
Click here to download the WMTV15 News app or our WMTV15 First Alert weather app.
Copyright 2026 WMTV. All rights reserved.
Jul 15, 2026 · via wmtv15news.com
The U.S. will formally bring together AI developers and essential services providers to share information on cybersecurity vulnerabilities identified by advanced AI systems and coordinate responses, according to a White House statement, fulfilling U.S. President Donald Trump’s order from June. Companies including Anthropic and OpenAI have released powerful AI systems capable of identifying software and infrastructure vulnerabilities at scale. U.S. officials worry that bad actors could use them to exploit weaknesses in the software systems underpinning critical services — including those of financial institutions, hospitals and energy networks — relied upon by Americans. The Trump administration set up a coordination group between leading AI developers and the essential services providers so they can share information about vulnerabilities they have discovered in their software and not duplicate efforts. The arrangement includes developers of open-source AI models, said White House cyber director Sean Cairncross. Cairncross did not specify which developers are involved. In the U.S., Nvidia, Meta Platforms and the startup Reflection offer open-source options. Trump in a June executive order directed the Treasury Department, National Cyber Director’s Office, Department of Defense and National Security Agency to set up the collaboration. This is the latest example of the Trump administration playing a more active role in the AI sector. Trump at the beginning of his second term said he would take a hands-off approach to the technology. That has shifted in recent months, with his administration taking a more active role in monitoring AI’s capabilities and considering the national security risks they present. (Reporting by Rozen in Washington; Writing by Bhargav Acharya; Editing by David Ljunggren and Matthew Lewis) Was this article valuable? Here are more articles you may enjoy.
Jul 15, 2026 · via claimsjournal.com
Cybersecurity researchers have disclosed details of a previously unreported Internet-of-Things (IoT) botnet framework dubbed TuxBot v3 Evolution that shows signs of being developed with assistance from a large language model (LLM), albeit with not so successful results. "While the AI complied with their request to generate botnet code, it included a safety disclaimer that the developer failed to remove before shipping," Palo Alto Networks Unit 42 said. "Although the LLM clearly aided in constructing the botnet, several functions in the analyzed samples failed to work correctly." The cybersecurity company said a manual code review would have resolved these errors and that it's possible more polished iterations of the malware exist out there in the wild. The botnet framework consists of multiple components: a C-based bot agent that cross-compiles for multiple architectures (e.g., ARM, MIPS, MIPSEL, MIPS64, x86_64, PowerPC, and RISC-V), a Go-based command-and-control (C2) server with a DDoS-for-hire panel, a custom exploit virtual machine, Docker-based test infrastructure, and an automated build system. The bot agent is designed to brute-force Telnet access on targeted devices with a set of 1,496 credential pairs, as well as incorporate exploit code targeting more than 30 IoT device families using known vulnerabilities. It communicates with the C2 server over an encrypted TCP channel, while resorting to a SHA512 domain generation algorithm (DGA), peer-to-peer (P2P) gossip protocol with Ed25519-signed commands, Internet Relay Chat (IRC), DNS TXT queries, and HTTP polling as a fallback mechanism. The modular framework's lineage has been traced back to three different botnets, like Mirai, AISURU, and Wuhan, in addition to partially porting some of its functions from the open-source MHDDoS Python DDoS toolkit. At least one sample of the malware was uploaded to the VirusTotal platform on January 20, 2026, indicating it has been around for over six months. Evidence suggests that
Jul 15, 2026 · via thehackernews.com
MADISON (WKOW) -- Insurance, investment and technology provider TruStage announced on Wednesday that it had been impacted by a cybersecurity incident.
According to a news release, the company engaged external cybersecurity experts to support containment, remediation and recovery efforts.
TruStage said it is working to understand the facts and will communicate as its understanding of the situation evolves. "Protecting the trust of the organizations and individuals TruStage serves is a core priority," the news release stated.
27 News reached out to TruStage for more information about the scope of the incident. Spokesperson Barclay Pollak said, "We are working as quickly and diligently as possible to determine the scope and impact of the incident, and do not yet have a confirmed timeline for when more details will be available."
Jul 15, 2026 · via wkow.com
Why Cybersecurity in AMI Networks Demands Open Standards Wi-SUN AllianceWi-SUN Alliance Smart meters are transforming how utilities operate. But every connected endpoint is also a potential point of cyber-attack. Standardized, IT-grade security — the foundation of Wi-SUN Field Area Network (FAN) — is the only durable defense for advanced metering infrastructure. Connecting meters and making them intelligent has driven one of the most consequential operational shifts at utilities over the past decade and a half. Advanced metering infrastructure (AMI) 1.0 has moved utilities from monthly truck rolls to continuous, granular visibility, and the operational gains are hard to overstate: A foundation has been laid for today’s advanced AMI 2.0 use cases. AMI 2.0 networks will place additional edge intelligence demands at the meter for waveform capture and analysis, load disaggregation, EV charging coordination, and distributed energy resource integration. However, the advantages of digitization create new challenges by expanding the cybersecurity attack surface of AMI systems. While much of a utility’s kit is locked within a substation’s physical perimeter or pole-mounted enclosures, an AMI network is the opposite. It’s distributed across an entire service territory, with every single endpoint physically accessible to anyone who can reach a meter base. There is no AMI perimeter to defend in the traditional sense, because the perimeter is everywhere. This accessibility changes the level of required security. Protecting each endpoint from rogue access is critical to protect the network, the system behind it, and the privacy of the consumption data tied to every customer. Compromising one meter cannot, under any circumstance, be allowed to compromise the network of meters or the services that ride on top of it. This is exactly how sophisticated attackers operate. They don’t break down the front door. They find the weakest entry point in the network, get in, and move
Jul 15, 2026 · via iotforall.com
Analysts are also largely positive on the other cybersecurity names, although the 12-month average price targets imply downsides.
CRWD, PANW, NET, ZS: What Is Wall Street’s View?
What’s The Retail View On CRWD, PANW, NET, ZS Stocks?
Meanwhile, retail sentiment around NET stock was in the ‘extremely bullish’ territory at the time of writing, while it was ‘bullish’ for ZS stock.
CRWD stock has surged more than 85% so far this year, PANW stock has rallied nearly 97% and NET stock has gained more than 43%.
Jul 15, 2026 · via stocktwits.com
BEIJING – The Chinese Foreign Ministry on Tuesday accused the United States of repeatedly using "cybersecurity" as an excuse to smear China for its geopolitical agenda, saying China is strongly dissatisfied with and firmly opposes this.
Ministry spokesperson Lin Jian made the remarks at a daily news briefing, in response to media reports that the United States and Paraguay had detected infiltration into the Paraguayan government's cyber systems, which they said was linked to China.
READ MORE: US's repeated use of 'cybersecurity' as excuse to smear China firmly opposed
Lin made it clear that China is against hacking and combats it in accordance with the law. Meanwhile, China is firmly against politically motivated disinformation concerning cybersecurity.
The US has long engaged in systemic global cyber attacks and made other countries join it in slandering China on cybersecurity, only to advance its own geopolitical agenda, he said, adding that China strongly deplores and firmly rejects this.
"We urge those countries not to be used as geopolitical tools and accomplices of the US government in spreading the 'Chinese cyber attack' disinformation," said the spokesperson.
Jul 15, 2026 · via chinadailyasia.com
(CNN) — The White House is establishing a new AI cybersecurity clearinghouse to help coordinate cybersecurity defenses across critical infrastructure. Industries and critical infrastructure are racing to catch up with new AI models with increasingly advanced abilities that can find and exploit (but also defend against) cybersecurity vulnerabilities. Some AI companies have even held off widely releasing their most advanced models to allow key partners time to patch vulnerabilities before the models are widely available. The White House’s clearinghouse, dubbed Gold Eagle, is a joint project across the Treasury, the Department of Homeland Security and the Pentagon. AI and cybersecurity companies, along with critical infrastructure providers like utilities and banks, will use the platform to communicate and coordinate their efforts. “These new capabilities make vulnerability discovery at a scale … that we have not seen before,” a senior White House official told reporters during a briefing on Tuesday. The goal of the new clearinghouse is to “deconflict and make sure resources are not being wasted, fixing or scanning for the same vulnerabilities, that those vulnerabilities are validated,” the official added, “and then a team of industry and government engineers are working to triage, prioritize and fix those vulnerabilities.” The White House declined to specify which companies are part of this project, describing them as “open-source software partners and American critical infrastructure companies.” Open-source software’s source code is publicly available, allowing anyone to freely view, use, modify and distribute it. The most well-known AI models from companies like OpenAI, Google and Anthropic, are closed-source. Open-source software is ubiquitous but often run by volunteers who might not have the money and time to secure the code. In 2021, a critical bug in open-source software left hundreds of millions of devices around the world vulnerable to hacking and triggered a frantic response from
Jul 14, 2026 · via news8000.com
The White House is establishing a new AI cybersecurity clearinghouse to help coordinate cybersecurity defenses across critical infrastructure. Industries and critical infrastructure are racing to catch up with new AI models with increasingly advanced abilities that can find and exploit (but also defend against) cybersecurity vulnerabilities. Some AI companies have even held off widely releasing their most advanced models to allow key partners time to patch vulnerabilities before the models are widely available. The White House’s clearinghouse, dubbed Gold Eagle, is a joint project across the Treasury, the Department of Homeland Security and the Pentagon. AI and cybersecurity companies, along with critical infrastructure providers like utilities and banks, will use the platform to communicate and coordinate their efforts. “These new capabilities make vulnerability discovery at a scale … that we have not seen before,” a senior White House official told reporters during a briefing on Tuesday. The goal of the new clearinghouse is to “deconflict and make sure resources are not being wasted, fixing or scanning for the same vulnerabilities, that those vulnerabilities are validated,” the official added, “and then a team of industry and government engineers are working to triage, prioritize and fix those vulnerabilities.” The White House declined to specify which companies are part of this project, describing them as “open-source software partners and American critical infrastructure companies.” Open-source software’s source code is publicly available, allowing anyone to freely view, use, modify and distribute it. The most well-known AI models from companies like OpenAI, Google and Anthropic, are closed-source. Open-source software is ubiquitous but often run by volunteers who might not have the money and time to secure the code. In 2021, a critical bug in open-source software left hundreds of millions of devices around the world vulnerable to hacking and triggered a frantic response from Biden administration
Jul 14, 2026 · via cnn.com
Cybersecurity researchers have flagged a previously undocumented Rust-based remote access trojan (RAT) codenamed LabubaRAT that masquerades as NVIDIA software to blend into target environments. "LabubaRAT creates a reusable foothold for hands-on activity," Blackpoint Cyber researchers Sam Decker and Nevan Beal said in an analysis published today. "Once deployed, it can profile the host, identify security tools, receive operator commands, move files, capture screenshots, and proxy traffic through the affected system." The implant also supports multiple communication methods, including HTTPS, WebView2, and DNS tunneling, allowing attackers to maintain access to compromised hosts even if one pathway is detected and closed off. There are some signs that LabubuRAT is being offered under a malware-as-a-service (MaaS) model. The starting point of the attack chain is an executable named "nvidia-sysruntime.exe," which impersonates NVIDIA's container runtime toolkit. The sample, instead of hard-coding its command-and-control (C2) information, accepts a runtime configuration through command-line arguments. This allows the campaign operator to define various parameters that are key to establishing communication with the remote server, including the server details ("pipicka[.]xyz") and the polling interval used by the implant. Alternatively, the attacker can also supply these individual values in the form of one single Base64-encoded argument. "Because those values were provided at launch, the same compiled binary could be reused with different infrastructure, organizations, or campaign groupings instead of relying on a hard-coded server," the researchers noted. The configuration is then stored in a local SQLite database, following which it undertakes discovery operations to inventory the list of web browsers and security products installed on the host, specifically checking for the presence of Google Chrome, Mozilla Firefox, Microsoft Edge, Brave, Microsoft Defender, CrowdStrike, SentinelOne, Carbon Black, Sophos, Malwarebytes, Bitdefender, ESET, Kaspersky, McAfee, Symantec, and Trend Micro. In addition, it gathers the hostname, RAM size, CPU model, and the Windows
Jul 14, 2026 · via thehackernews.com