Only 7 days left to secure the Early Bird registration at the OpenSSL Conference 2025, October 7 – 9 in Prague. The event will bring together lawyers, regulators, developers, and entrepreneurs to explore issues of security and privacy for everyone, everywhere. Attendees will have the opportunity to: Early Bird pricing closes in 7 days. [REGISTRATION […]
A critical zero-click vulnerability in Zendesk’s Android SDK has been uncovered, enabling attackers to hijack support accounts and harvest every ticket without any user interaction. Discovered during a private bug bounty program, the flaw stems from weak token generation and storage mechanisms within Zendesk’s mobile application. Vulnerability Overview Zendesk’s Android client generates authentication tokens by […]
Dover, DE, United States, August 25th, 2025, CyberNewsWire Attaxion announces the addition of the Agentless Traffic Monitoring capability to its exposure management platform. Agentless Traffic Monitoring is a new capability designed to give cybersecurity teams actionable visibility into network traffic flowing to and from their digital assets – all without the need to deploy any agents or sensors […]
Dover, DE, United States, August 25th, 2025, CyberNewsWire
Attaxion announces the addition of the Agentless Traffic Monitoring capability to its exposure management platform. Agentless Traffic Monitoring is a new capability designed to give cybersecurity teams actionable visibility into network traffic flowing to and from their digital assets – all without the need to deploy any agents or sensors on these assets.
Attaxion uses real-time NetFlow data to provide its users with detailed context about inbound and outbound traffic—including source and destination IP addresses and ports, protocol used, and timestamps of when the traffic was first and last seen. Relying on global NetFlow data instead of local sensors allows to preserve the agentless nature of the solution, making sure Attaxion remains easy to use and doesn’t require deployment.
Using the NetFlow data and a combination of threat intelligence sources, Attaxion can distinguish between benign and malicious traffic, offering SOC analysts and cybersecurity engineers a quick and easy way of understanding which of their IP addresses are communicating with known malicious IP addresses.
Figure 1: Attaxion’s new Agentless Traffic Monitoring feature, identifying malicious traffic to and from the organization’s IP addresses
A diverse set of connected threat intelligence feeds allows Attaxion to highlight the exact type of attack and in some cases even the exact malware family that is generating the traffic.
The new feature speeds up incident response, malware detection, and threat hunting, and makes vulnerability management much more effective, allowing network administrators and security engineers to focus on what’s relevant right now.
“With the level of detail that Agentless Traffic Monitoring provides, security teams can immediately see which assets are interacting with known malicious infrastructure,” said Max Beatty, Head of Growth & Strategy at Attaxion, “This context is incredibly valuable when prioritizing risk. If an asset with a known vulnerability is communicating with a malicious IP, that should be your top priority.”
The Agentless Traffic Monitoring feature is built to help reduce alert fatigue and focus remediation efforts on high-risk areas within the attack surface.
Key capabilities include:
Real-time traffic visibility across all exposed assets.
Automatic classification of malicious traffic and attack type.
Integration with threat intelligence feeds to detect attack types and malware families.
Asset-level context to support vulnerability prioritization.
Figure 2: Attaxion’s Agentless Traffic Monitoring identifies recent command-and-control (C2) activity across malware families and timeframes
Agentless Traffic Monitoring is now available for Attaxion customers as part of its growing suite of continuous monitoring tools.
Attaxion helps organizations discover, monitor, and secure their internet-facing assets. The platform combines automated discovery, continuous assessment, and guided remediation to deliver 97% greater asset visibility and AI-driven vulnerability prioritization — making robust cyber defense accessible to teams of every size. To support early evaluation and integration, Attaxion is available with a 30-day free trial and an asset finder preview tool.
Cybercriminals have unveiled a novel variation of the ClickFix social engineering technique that weaponizes AI-powered summarization tools to stealthily distribute ransomware instructions. By leveraging invisible prompt injection and a “prompt overdose” strategy, attackers embed malicious directives within hidden HTML elements that AI summarizers in email clients, browser extensions, and productivity platforms faithfully reproduce in their […]
Over the past year, security teams have observed an uptick in adversaries leveraging native Windows Scheduled Tasks to maintain footholds in compromised environments.
Unlike elaborate rootkits or zero-day exploits, these techniques exploit built-in system functionality, enabling threat actors to persist without deploying additional binaries or complex toolchains.
By integrating malicious commands directly into Task Scheduler jobs—triggered on boot, logon, or at timed intervals—attackers achieve stealthy, resilient access that often eludes conventional detection mechanisms.
Initial infections typically begin with phishing emails or exploit kits delivering lightweight loaders that pivot quickly to persistence.
Once they achieve execution on the endpoint, attackers invoke either the schtasks.exe binary or PowerShell cmdlets to register new tasks or modify existing ones. These jobs may execute under the SYSTEM account, further complicating detection.
Early samples targeted financial institutions, while more recent campaigns have expanded into critical infrastructure sectors, highlighting the broad applicability and low operational cost of Scheduled Tasks abuse.
The DFIR Spot analysts noted the malware’s reliance on triggers such as LogonTrigger and TimeTrigger, configured to execute every five minutes or upon each user logon.
In multiple engagements, Incident Response teams discovered tasks named to mimic legitimate Windows services—such as “TelemetryUpdater” or “HealthCheck”—but pointing to executables stored in unconventional directories under C:\ProgramData\System.
This approach allows the malicious components to blend into routine system activity, delaying analysis and remediation.
Subsequent payloads delivered via these tasks range from coin-mining binaries to remote administration tools.
Once registered, tasks often self-update by invoking PowerShell scripts that pull additional modules or change command-line arguments.
Because Task Scheduler logs can be cleared or disabled by attackers, many organizations have struggled to reconstruct timelines without enriched EDR telemetry.
Persistence Tactics: Malicious Task Registration and Execution
A core persistence mechanism involves the command-line invocation:-
Scheduled Task Creation Command (Source – The DFIR Spot)
In this snippet, the /sc minute /mo 5 parameters dictate a five-minute interval, while the task name and directory structures mimic authentic Windows updates. Attackers frequently choose TimeTrigger elements in the XML task file to specify both start boundaries and indefinite repetition, as in:
Malicious Task XML Configuration (Source – The DFIR Spot)
After creation, the job executes with SYSTEM privileges, launching a loader that contacts a remote C2 or payload repository.
By embedding the executable in nonstandard paths and abusing native scheduling features, threat actors achieve persistence without requiring additional exploitation frameworks.
Detection strategies must include rigorous baselining of legitimate scheduled tasks, monitoring TaskScheduler/Operational logs for Event ID 106 (task registered), and enforcing advanced audit policies to capture Event ID 4698 entries.
Combining these logs with EDR-driven process lineage analysis can reveal anomalous task creation patterns that diverge from normal administrative operations.
Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.
Doctor Web’s antivirus laboratory has identified a sophisticated Android backdoor malware, designated Android.Backdoor.916.origin, which has been evolving since its initial detection in January 2025. This multifunctional spyware primarily targets representatives of Russian businesses through targeted attacks rather than mass distribution. Attackers disseminate the malicious APK file via private messages in popular messengers, disguising it as […]
Security researcher Mattia “0xbro” Brollo disclosed a trio of severe vulnerabilities in vtenext CRM (versions 25.02 and earlier) that enable unauthenticated attackers to completely bypass login controls and execute arbitrary code on affected installations. Although vtenext quietly patched one of these flaws in version 25.02.1, two equally dangerous vectors remain unaddressed—placing countless small and medium‐sized […]
The Arch Linux Project has officially confirmed that its primary infrastructure services have been subjected to an ongoing distributed denial-of-service (DDoS) attack that has persisted for over a week.
The attack severely impacted user access to critical resources, including the main website, Arch User Repository (AUR), and community forums.
Key Takeaways 1. A week-long DDoS has taken down Arch Linux’s site, AUR, and forums. 2. DevOps uses rate limits, TCP SYN auth, and geo-mirrors. 3. Mitigation continues with partners, DDoS provider evaluation, and live status updates.
DDoS Attack Campaign
The DDoS campaign began affecting Arch Linux services around August 16, 2025, with Leonidas Spyropoulos from the DevOps team initially reporting service disruptions at 5:13 AM. The attack has specifically targeted three core infrastructure components:
archlinux.org (main website)
aur.archlinux.org (Arch User Repository)
bbs.archlinux.org (community forums)
The DevOps team confirmed on August 21 that the attack represents a sustained volumetric DDoS pattern designed to overwhelm the project’s hosting infrastructure through massive traffic floods.
The attack has triggered TCP SYN authentication mechanisms deployed by their hosting provider, causing initial connection resets before legitimate requests can be processed.
Additionally, the attack methodology involves Layer 3/4 flood attacks that saturate network bandwidth and exhaust server resources.
The team has implemented emergency rate limiting and traffic filtering measures while working with their data center operator to deploy additional DDoS scrubbing capabilities.
Emergency Workarounds
The Arch Linux team has established multiple failover mechanisms to maintain essential functionality during the ongoing attack:
For package management, users can leverage the pacman-mirrorlist package’s default mirror configuration when the primary reflector endpoint becomes unavailable.
The team maintains geo-distributed mirrors at geo.mirror.pkgbuild.com for ISO downloads, with mandatory GPG signature verification using key 0x54449A5C.
AUR package access remains possible through the GitHub mirror repository using the command:
Documentation access continues via the arch-wiki-docs and arch-wiki-lite packages, which contain recent snapshots of the official wiki content.
The team has established a dedicated status.archlinux.org endpoint for real-time service monitoring and incident communications, implementing automated health checks across all critical infrastructure components.
As this volunteer-driven project continues evaluating comprehensive DDoS protection providers while balancing cost, security, and ethical considerations, the DevOps team maintains operational security by keeping specific attack vectors and mitigation tactics confidential until the incident is fully resolved.
Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.
Cybersecurity today moves at the pace of global politics. A single breach can ripple across supply chains, turn a software flaw into leverage, or shift who holds the upper hand. For leaders, this means defense isn’t just a matter of firewalls and patches—it’s about strategy. The strongest organizations aren’t the ones with the most tools, but the ones that see how cyber risks connect to business
.webp)
.webp)
