Tag: attack
-
At RSAC 2026, AI Redefines the Future of Penetration Testing
Penetration testing is undergoing a substantial shift as AI reshapes both attack and defense strategies. At RSA Conference 2026, multiple vendors pointed to the same underlying pressure: Attack surfaces are expanding more quickly, while the time required to detect and address weaknesses is shrinking. That shift is being driven in part by the rise of..…
-
Medtech giant Stryker says it’s back up after Iranian cyberattack
The Handala group claimed responsibility for hitting the company with a wiper attack last month. First seen on cyberscoop.com Jump to article: cyberscoop.com/medtech-giant-stryker-says-its-back-up-after-iranian-cyberattack/
-
Software supply chain hacks trigger wave of intrusions, data theft
After linking the Axios npm supply chain attack to North Korean hackers, Google researchers warned that >>hundreds of thousands of stolen secrets could potentially be … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/04/02/supply-chain-hacks-data-theft/
-
Software supply chain hacks trigger wave of intrusions, data theft
After linking the Axios npm supply chain attack to North Korean hackers, Google researchers warned that >>hundreds of thousands of stolen secrets could potentially be … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/04/02/supply-chain-hacks-data-theft/
-
New Progress ShareFile flaws can be chained in pre-auth RCE attacks
Two vulnerabilities in Progress ShareFile, an enterprise-grade secure file transfer solution, can be chained to enable unauthenticated file exfiltration from affected environments. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/new-progress-sharefile-flaws-can-be-chained-in-pre-auth-rce-attacks/
-
Medtech giant Stryker fully operational after data-wiping attack
Stryker Corporation, one of the world’s leading medical technology companies, says it’s fully operational three weeks after many of its systems were wiped out in a cyberattack claimed by the Iranian-linked Handala hacktivist group. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/medtech-giant-stryker-fully-operational-after-data-wiping-attack/
-
Researchers Observe Sub-One-Hour Ransomware Attacks
Halcyon says Akira is now capable of carrying out an entire ransomware attack in less than an hour First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/researchers-subonehour-ransomware/
-
How to Improve Google Workspace Phishing Protection for Schools Without Adding IT Burden
Phishing attacks remain one of the most common, and most successful, cyber threats targeting K12 schools. As districts continue to rely on Google Workspace for communication, collaboration, and file sharing, it has become a prime entry point for attackers looking to exploit human error and gain access to sensitive data. While Google Workspace includes baseline…
-
EvilTokens abuses Microsoft device code flow for account takeovers
A phishing package with post-compromise focus: Beyond the initial access vector, EvilTokens is structured as a full-service phishing platform. The kit provides affiliates with ready-to-use lures, infrastructure, and automation tools designed to carry out both the phishing phase and post-compromise activity.The lures used in the campaign include fake SharePoint document notifications, DocuSign requests, and account…
-
Shut the Front Door on Email Attacks: How to Scale Security Services Without Increasing Workload
<div cla Email remains the primary entry point for cyberattacks, driven largely by phishing and account compromise. For attackers, it is often the simplest and most scalable way to gain access: send enough emails, and eventually, someone clicks. What’s changing is not the entry point, but the sophistication of the attacks. First seen on securityboulevard.com…
-
Qilin EDR killer infection chain
This blog provides an in-depth analysis of the malicious “msimg32.dll” used in Qilin ransomware attacks, which is a multi-stage infection chain targeting EDR systems. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/qilin-edr-killer/
-
Inside the Talos 2025 Year in Review: A discussion on what the data means for defenders
A conversation between Cisco Talos and Cisco Security leaders on the 2025 threat landscape, from identity attacks and legacy vulnerabilities to AI-driven threats, and what defenders should prioritize now. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/inside-the-talos-2025-year-in-review-a-discussion-on-what-the-data-means-for-defenders/
-
Most CNI Firms Face Up to £5m in Downtime from OT Attacks
E2e-assure says 80% of critical infrastructure providers could face millions in downtime from cyber-attacks First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/most-cni-firms-5m-downtime-ot/
-
Over 14,000 F5 BIG-IP APM instances still exposed to RCE attacks
Internet security watchdog Shadowserver has found over 14,000 BIG-IP APM instances exposed online amid ongoing attacks exploiting a critical-severity remote code execution (RCE) vulnerability. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/over-14-000-f5-big-ip-apm-instances-still-exposed-to-rce-attacks/
-
New ZAP PTK Add-On Converts Browser Security Findings Into Native ZAP Alerts
The OWASP Zed Attack Proxy (ZAP) just received a massive upgrade for testing modern web applications. The release of the ZAP PTK Add-on 0.3.0, working alongside OWASP PenTest Kit (PTK) 9.8.0, now converts browser-based security findings directly into native ZAP alerts. Traditionally, ZAP excels at analyzing server-side behavior, HTTP headers, and proxy-layer traffic. However, modern…
-
WhatsApp Attack Chain Delivers VBS, Cloud Payloads, MSI Backdoor
A new malware campaign that abuses WhatsApp messages to deliver malicious Visual Basic Script (VBS) files to Windows users, enabling persistent remote access through unsigned MSI installers. The campaign starts with WhatsApp messages carrying VBS attachments that appear benign but execute as scripts when opened on Windows. Once launched, the initial script creates hidden folders…
-
Vim and GNU Emacs: Claude Code helpfully found zero-day exploits for both
P_MLE and P_SECURE) in the tabpanel sidebar introduced in 2025, and a missing security check in the autocmd_add() function.Claude Code then helpfully tried to find ways to exploit the vulnerability, eventually suggesting a tactic that bypassed the Vim sandbox by persuading a target to open a malicious file. It had gone from prompt to proof-of-concept…
-
North Dakota water treatment plant reports March ransomware attack
A water treatment plant in the city of Minot, North Dakota, was hit with ransomware but city officials said it continues to operate normally. First seen on therecord.media Jump to article: therecord.media/north-dakota-ransomware-water-plant
-
CERT-UA Impersonation Campaign Spread AGEWHEEZE Malware to 1 Million Emails
The Computer Emergency Response Team of Ukraine (CERT-UA) has disclosed details of a new phishing campaign in which the cybersecurity agency itself was impersonated to distribute a remote administration tool known as AGEWHEEZE.As part of the attacks, the threat actors, tracked as UAC-0255, sent emails on March 26 and 27, 2026, posing as CERT-UA to…
-
Key Leaks, Vault Failures, and TEE Attacks: Highlights from RWC 2026
What resonated most at RWC 2026? GitGuardian highlights key research on private key leaks, password managers, trusted execution environments, and secret sprawl. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/04/key-leaks-vault-failures-and-tee-attacks-highlights-from-rwc-2026/
-
Iran Threatens to Attack Apple, Google, and Other US Tech Firms in Middle East
Iran has threatened multiple US tech giants in the Middle East, escalating tensions and raising fears of AI-driven warfare turning physical. The post Iran Threatens to Attack Apple, Google, and Other US Tech Firms in Middle East appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-iran-threatens-us-tech-firms-middle-east/
-
Cyberattacks Intensify Pressure on Latin American Governments
Cyber threats across Latin America are increasingly targeting government systems, from disruptive attacks in Puerto Rico to a surge of probes against Colombia’s health sector. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/cyberattacks-latin-american-governments
-
Axios open-source library targeted in sophisticated supply chain attack
Researchers link the compromise to a North Korean adversary and warn the impacts could be wide ranging. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/axios-open-source-library-targeted-in-sophisticated-supply-chain-attack/816343/
-
Iran Calls U.S. Tech Companies ‘Legitimate Targets,’ Threatens to Attack
The Iranian government is threatening to attack the Middle East operations of more than a dozen U.S. tech companies, including Microsoft, Nvidia, and Google, calling them “legitimate targets.” Meanwhile, pro-Iranian threat groups expand their operations as the U.S. and Israel continues their bombing campaign against Iran. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/04/iran-calls-u-s-tech-companies-legitimate-targets-threatens-to-attack/
-
Google links Axios npm supply chain attack to North Korea-linked APT UNC1069
Google links the Axios npm supply chain attack to North Korean threat group UNC1069, targeting financial gain. Google has attributed the recent Axios npm supply chain compromise to a North Korean threat group tracked as UNC1069. The attack, aimed at financial gain, exploited the package to target developers and organizations relying on Axios. John Hultquist…
-
Backdooring of JavaScript Library Axios Tied to North Korea
Expect Fallout After Remote Access Trojan Added to Popular JavaScript NPM Package. A supply-chain attack backdoored versions of Axios, a popular JavaScript library that’s present in many different software packages, to distribute a cross-platform, remote access Trojan. Identifying the full fallout from the attack could take some time, experts warned. First seen on govinfosecurity.com Jump…