Cyberattacks
PaperCut released an emergency patch on Friday to fix critical vulnerabilities in its print management software. The company confirmed that multiple customers were targeted in directed attacks and collaborated with security researchers from Huntress and watchTowr in response. The vulnerabilities involve improper access control and insecure dynamic class loading, which can be chained to achieve unauthorized full compromise.
Sygnia released a report on Sunday disclosing that a sophisticated hacker group linked to our country (codenamed Fire Ant) is exploiting routers running the Cisco IOS XR operating system to conduct espionage, targeting high-value networks and critical infrastructure. The group previously gained widespread attention for abusing VMware environments in 2025. The investigation found that attackers stole credentials by manipulating the TACACS authentication process and deployed BridgeAgent, a backdoor tool disguised as Zabbix, along with TacTap, a credential-stealing tool. Sygnia recommends that security teams adopt measures such as restricting privileged access, monitoring abnormal tunnel interfaces, and centralizing authentication to defend against these threats.
