Dennis Fisher

UNC6395 Expands Data Theft Campaign to Email OAuth Tokens

Google researchers discovered the new attacks and are advising all customers to treat any authentication tokens for those integrations as compromised.

AUG 27

Citrix CVE-2025-7775 Under Active Attack

The vulnerability (CVE-2025-7775) is a buffer overflow that can lead to remote code execution and attackers were already targeting it before the public disclosure.

AUG 8

CISA, Microsoft Warn of Exchange CVE-2025-53786 Risk

CISA has issued an emergency directive regarding the recently disclosed and somewhat weird vulnerability in Microsoft Exchange hybrid deployments (CVE-2025-53786), ordering all civilian federal agencies to address the flaw by Aug. 11.

AUG 5

Attacks Hit Possible SonicWall Zero Day

Attackers are exploiting a likely zero day vulnerability in some versions of SonicWall Firewall devices with the SSL VPN functionality enabled, and in some cases are able to bypass MFA protections. The intrusions have been ongoing since at least the end of last week, and researchers have observed some attackers deploying the Akira ransomware after…

AUG 4

New PXA Stealer Campaign Hits Victims Worldwide

A group of attackers with ties to the Vietnamese cybercrime underground ecosystem are running a significant campaign across many different countries that is delivering the PXA Stealer malware and uses novel sideloading and anti-analysis techniques to slip past defensive measures. The campaign has targeted victims in more than 60 countries and the attackers have harvested…

AUG 1

Microsoft Finds Secret Blizzard Targeting Foreign Diplomats

Microsoft has uncovered a long-running campaign by a threat group affiliated with Russian intelligence that has targeted diplomats working in Russia with a custom tool called ApolloShadow that enables the group to maintain persistence on victims’ devices as part of a cyberespionage operation. The group is known as Secret Blizzard and Microsoft’s researchers found that…

Chinese Attackers Target SharePoint CVE-2025-53770

Three separate Chinese threat groups are exploiting a set of recently disclosed vulnerabilities in on-premises Microsoft SharePoint installations, and Microsoft and CISA are urging companies that haven’t yet updated their installations to do so as quickly as possible. Microsoft first published information about the two flaws (CVE-2025-53770 and CVE-2025-53771) on July 19 after seeing active…

Dennis Fisher · 1 min

‘Nothing’s Going to Last Forever’: An Oral History of the L0pht, Part 4

As the 1990s drew to a close, the curtain was coming down on the L0pht, as well. Security companies were helping to fuel the first dot-com boom, and venture capitalists and investors took the place of the law enforcement agencies that once circled the group. The L0pht members considered their options: continue as an independent…

Dennis Fisher · 9 min

Thirty Minutes Or Less: An Oral History of the L0pht, Part 3

By the beginning of 1998, the national media had decided that cybersecurity was something worth paying attention to and the members of the L0pht were ready and willing to help explain the issues and weaknesses that all of this new technology brought with it. Pieces in The Washington Post, Wired, and many other outlets raised…

Dennis Fisher · 9 min

‘Microsoft Was Freaking Out’: An Oral History of the L0pht, Part 2

As the L0pht began to coalesce and become more well-known in the security community, the dynamics of the group evolved, too. The loft space in Boston’s South End became a hangout and meeting spot for local hackers, and as some of the members flourished, others began to pull back from the group. At the same…

Dennis Fisher · 11 min