Posts by Spartech Software

Defense Advanced Research Projects Agency (DARPA) has issued a significant call to the private sector, urging industry partners to assist in improving and strengthening cybersecurity for the Department of Defense (DoD). This initiative is part of a broader strategy to address escalating cyber threats targeting U.S. military and critical infrastructure systems.

The threat actors behind the Qilin ransomware-as-a-service (RaaS) scheme have recently introduced a “Call Lawyer” feature, offering legal counsel to their affiliates as a means to increase pressure on victims during ransom negotiations. This development is part of a broader strategy to make Qilin stand out in the cybercrime marketplace by providing a full suite of services to affiliates, including legal assistance, negotiation support, data storage, DDoS capabilities, and even media support.

On Wednesday night, June 18, 2025, Iran’s state-owned television broadcaster was hacked, interrupting regular programming to air videos calling for street protests against the Iranian government. The broadcast was briefly hijacked, with footage showing women cutting their hair and messages urging citizens to “rise up” and “take control of your future”. The disruption was widely shared on social media and quickly drew both domestic and international attention.

SecurityWeek reported this week that WhatsApp, owned by Meta, confirmed its researchers had requested the CVE identifier CVE-2025-27363 after linking the flaw to an exploit used by Paragon, an Israeli surveillance solutions provider. The vulnerability, CVE-2025-27363, is an out-of-bounds write in the FreeType open-source library, which could allow for arbitrary code execution. This flaw was initially highlighted in a Meta advisory in mid-March 2025, warning that it may have been exploited in the wild.

A critical-severity vulnerability (CVE-2025-4322) was discovered in the popular Motors theme for WordPress, affecting all versions up to and including 5.6.67. This flaw allowed unauthenticated attackers to escalate privileges by resetting passwords for any user, including administrators, resulting in full site takeover.

Banana Squad, a threat actor group, has been running a sophisticated malware campaign by hiding data-stealing malware in fake GitHub repositories. These repositories were designed to look like legitimate Python-based hacking tools, tricking developers and users into downloading and running malicious code.