Innholdsfortegnelse for September 2025 i Hackercool Magazine

Then you will know the truth and the truth will set you free. John 8:32 Welcome to this month’s issue of Hackercool Magazine, where we dive headfirst into the evolving—and often unsettling—landscape of digital defense and offense. As we step closer to 2026, the line between attacker and defender continues to blur, powered by advancements in AI, automation, and adaptive threat strategies. In this issue, we start with a look inside the future of Red teaming against AI-powered defenses, unpacking the next generation of tactics, techniques, and tools security professionals must master. The battlefield is changing, and human creativity remains the ultimate exploit. Our vulnerability coverage this month is extensive and essential. From the Chrome zero-day (CVE-2025-10585) already under active exploitation, to critical exposures in Gladinet’s Triofox (CVE-2025-11371) and Cisco…

Blue teams, whether in a small security operation center (SOC) of a small startup or a large enterprise face the same problem. They have more things to protect in an organization than budget or people to watch them. That’s where the role of open-source tools becomes important for every blue team. Why open source matters for Blue Teams Open source software (OSS) is crucial for blue teams because it offers a cost-effective access to powerful security tools without the licensing fees of commercial alternatives. The auditability of open-source tools allows defenders to inspect code for backdoors, vulnerabilities or compliance with internal standards which are very critical in high-trust environments. Open source Blue team tools also enable deep customization, letting teams tailor tools to their unique threat models and infrastructure. The…

A critical zero-day vulnerability affects thousands of Cisco ASA firewalls is being actively exploited by threat actors in real-world. About the vulnerabilities The vulnerability being tracked as CVE-2025-20333 has a CVSS score of 9.9. The vulnerability affects Cisco Secure Firewalls Adaptive Security Appliance (ASA) and Cisco Secure Firewalls Threat Defense (FTD) software. The affected versions are Cisco ASA 9.12, 9.14, 9.16 to 9.20 and 9.22 to 9.23 and FTD versions 7.0 to 7.4 and 7.6 to 7.7. It specially affects the VPN web server components. The vulnerability is an improper validation of user-supplied input in HTTP (s) requests processed by the VPN web server. It allows authenticated remote attackers to trigger a buffer overflow and execute malicious code with root privileges on vulnerable devices. Devices running vulnerable release of ASA…

An unknown malware strain is targeting thousands of Android users across Europe and stealing money from their bank accounts. Beware of this bankinking Trojan. About the malware Klopatra was first discovered by Cleafy’s Threat Intelligence team in late August 2025. This malware strain masquerades as a pirated TV and streaming app. Method of infection It specifically targets users searching for pirated TV streaming apps. This particular malware strain marquerades as “Mobdro Pro IP TV+VPN” an IPTV application. Since applications like these are not allowed on Google Play store, the target users are tricked into downloading the applications from unknown sources. If the user falls for this and installs the application from external sources, the application convinces the user to grant critical permissions to the app on the device. The malware…

Like everything, Artificial Intelligence (AI) is changing cyber battlefield too very fast. It is being used by both attackers and defenders to good use. While attackers are using AI to make their attacking techniques more sophisticated, Blue teams are using AI to improve their defense techniques. This employment of AI by Blue teams poses a never before challenge to Red Teams during engagement. In the feature of this month’s Issue, we bring our readers how Red Teams should fight against AI-powered Defenses in 2025. Why Blue teams are opting for AI powered defenses The Rise of AI in Blue teaming provides a lot of advantages to the blue team. Most important of them are given below. AI red teaming is emerging as one of the most effective first steps businesses…

Cybersecurity company Huntress has detected a zero-day vulnerability under active exploitation in real-world affecting Gladinet Centrestack and Trio-Fox products. Gladinet Centrestack and TrioFox are enterprise file-sharing and cloud storage solution that provide secure VPN less remote access to file About the vulnerabilities The zero-day vulnerability being tracked as CVE-2025-11371 with a CVSS score of 6.1 is an unauthorized local file inclusion vulnerability that allows unauthorized users to view system files. All versions of Gladinet Centrestack and Triofox prior to 16.7.10368.56.560 are vulnerable. “We are one year away from AI conducting real attacks autonomously.”-Kevin Mandia, Founder of Mandiant Earlier, both Gladinet centrestack and Triofox were affected by CVE-2025-30406 (with a CVSS score of 9.0) that allowed hackers to perform remote code execution by exploiting a view state deserialization vulnerability that allowed…

The latest version of Tails operating system, the Tails 7.0 has been released recently. Let’s see what’s new in this latest version of Tails. To those newbies who have no idea what Tails is, it is The Amnesiac Incognito Live System. In simple terms, it is a privacy focused Linux distribution specifically designed to keep you anonymous and secure on internet. Latest features to be excited about One feature that can make you very excited about the latest version of Tails is its faster boot time. This improved boot time is thanks to the change of USB/ISO image compression algorithm to ztsd from xz. This will result in a 10-15 second faster boot on most machines. Change of Base OS Tails 7.0 is based on Debian 13 “Trixie”, the latest…

Nowadays data breaches aren’t rare shocks – they’re a weekly drumbeat. From leaked customer records to stolen source code, our digital lives keep spilling into the open. Git services are especially vulnerable to cybersecurity threats. These are online hosting platforms that are widely used in the IT industry to collaboratively develop software, and are home to most of the world’s computer code. Just last week, hackers reportedly stole about 570 gigabytes of data from a git service called GitLab. The stolen data was associated with major companies such as IBM and Siemens, as well as United States government organisations. "Cyberattackers can also quietly insert malicious code into existing projects without a developer’s knowledge. These so-called “software supply-chain” attacks have turned development tools and update channels on git services into high-value…

Google Chrome has released an urgent security update to fix four vulnerabilities including a critical vulnerability that is being actively exploited in real-world. About the vulnerabilities The four vulnerabilities that have been fixed in Chrome are CVE-2025-10585, CVE-2025-11458, CVE-2025-11460 and CVE-2025-11211. Dangerous among them is CVE-2025-10585 which is a zero-day vulnerability that is already being exploited in real-world by threat actors. It is a critical Type Confusion vulnerability in the V8 JavaScript and WebAssembly feature of Chromium engine with a CVSS v3.1 base score of 9.8. Type confusion vulnerabilities are considered very dangerous as they can be weaponized by threat actors to trigger unexpected software behaviour which includes execution of malicious code. CVE-2025-10585 is the sixth zero-day vulnerability detected in Chrome browser that has been either actively exploited or demonstrated…

The third release of Kali this year, Kali 2025.3 has been released recently. Let’s see what’s new in the latest release. To those who have no idea, Kali Linux is a penetration testing, Red teaming distro. Latest features to be excited about New tools What is a new release of Kali if it doesn’t have new tools? This release adds 10 new tools to its network repositories. Important among them are, 1) Caido and Caido-cli The client side and server side of Caido a web security auditing toolkit has been added. “Corporate security is not about attack and defense. The term blue team connotes a game or a match, one side against the other … but most of the time you’re having a discussion with a colleague about finding the…

Researchers at Cybersecurity company Huntress have warned that Sonic-Wall SSLVPN devices are being compromised on a large scale around the world. About the vulnerability Threat actors are authenticating into multiple SonicWall devices using valid VPN credentials. The speed with which these logins are happening suggests that the attackers have valid credentials and definitely not brute forcing. How the attackers got hold of so many valid accounts is the big question. A few days back SonicWall reported that there was a security incident which resulted in firewall configuration backup files stored in MySonicWall accounts getting exposed. “Hackers are the immune system of the digital world.”—Unknown This break affected all customers who use SonicWall cloud backup service. These configuration files contain important information like user, group, domain setting, DNS, log setting, certificate…