🕵️ RESEARCH & DEEP DIVES
-
RAVEN Demonstrates Elasticsearch Data Theft and Persistent Backdoor Access
RAVEN can exfiltrate Elasticsearch data and restore deleted access mechanisms.- Exposed or compromised Elasticsearch clusters and Kibana environments are affected.
- RAVEN exports selected or all non-system indices as NDJSON and can create server-side snapshots.
- The tool creates rogue users, long-lived API keys, and Watcher tasks that recreate deleted access.
- Testing used Docker-based Elasticsearch 7.17.22; RAVEN uses the Point-in-Time API on newer releases and Scroll before 7.10.
📄 Source: levelblue.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News
-
Fake Crypto AML Checkers Trick Users Into Draining Their Wallets
Scammers are using fake crypto AML-checking sites to drain users’ wallets.- Crypto wallet users are targeted.
- Fake sites impersonate legitimate anti-money-laundering services.
- The sites trick users into approving wallet access for scammers.
- Approved access lets attackers drain victims’ cryptocurrency.
📎 Coverage: securityboulevard.com · 👁 via securityboulevard.com (discovered)
📋 ADVISORIES
-
NIST Releases Cybersecurity Tips for Building Automation Systems
NIST released cybersecurity guidance for building automation and control systems.- Commercial and federal building owners and operators are the primary audience.
- Building Automation & Control Systems manage HVAC, lighting, access control, fire alarms and energy systems.
- Integration with corporate networks and cloud services increases BACS exposure to cyberattacks.
- The guidance also applies to OT environments in water, transportation, energy, manufacturing, healthcare and food/agriculture.
📎 Coverage: nist.gov · 👁 via NIST Cybersecurity Insights
-
📌 4 | 📄 Source for StopAndProtect Uses Nearly 2,000 Hacked WordPress Sites for Malware Operations — blog.checkpoint.com
🔓 CVEs & KEV
- CVE-2026-52813 — CVSS 10.0 — Yet another RCE in Gogs, but it's fixed this time!