HighRansomware
⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests
The Hacker News·Source published ·1 min read
What happened?
A blank field. A public repo. One reply to an email. A box left exposed. None of this sounds dramatic, which is partly the problem. This week’s threats keep finding leverage in small things that were easy to overlook. There are actively exploited bugs in the mix, cleaner intrusion paths, smarter automation, and a long patch list waiting behind them. Some attacks are getting more capable. Others
Key details
- FortiMail zero‑day lets unauthenticated attackers write arbitrary files via crafted web requests.
- RatHat Android malware uses Google Gemini to classify victims by bank balance and swaps its C2 panel.
- AI coding agents leaked over 13,000 internal screenshots to public GitHub repositories (PixelLeak).
Affected
- Fortinet FortiMail is vulnerable to active exploitation.
- Star Blizzard targets Ukrainian entities, NGOs, think tanks, governments and policy‑related organizations.
- NeedyMantis has been seen in telecoms, universities, medical nonprofits, intergovernmental bodies and government contractors.
What to look for
- Exploitation requires NetScaler to be configured as a SAML SP or IdP.
- FortiMail can be abused to write files via crafted HTTP/HTTPS requests.
- RedFlick phishing chain succeeds with a single user interaction.
- RatHat uses Gemini to assess victims' bank balances.
- AI agents host leaked screenshots in adjacent public repositories.
Summarised by SecOraLens from The Hacker News. Always read the original source before acting. How SecOraLens verifies advisories.