Tag: detection
-
Hypotheses, telemetry, and human judgment: Inside Cisco Talos Threat Hunting
Learn how Cisco Talos Threat Hunting uses hypothesis-driven methods and multi-domain telemetry correlation to find stealthy threats operating below automated detection thresholds. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/hypotheses-telemetry-and-human-judgment-inside-cisco-talos-threat-hunting/
-
Gamaredon Uses WinRAR Vulnerability to Launch Modular Spy Campaign on Ukrainian Targets
Gamaredon exploits a WinRAR flaw to drop modular, nearly fileless malware on Ukrainian targets, hiding payloads in Windows streams and resolving C2s via Telegram. Sekoia’s Threat Detection & Research team dropped a YARA rule in late December 2025 to hunt for new initial access vectors, and by January 2026 it had already generated a dozen…
-
Gamaredon Uses WinRAR Vulnerability to Launch Modular Spy Campaign on Ukrainian Targets
Gamaredon exploits a WinRAR flaw to drop modular, nearly fileless malware on Ukrainian targets, hiding payloads in Windows streams and resolving C2s via Telegram. Sekoia’s Threat Detection & Research team dropped a YARA rule in late December 2025 to hunt for new initial access vectors, and by January 2026 it had already generated a dozen…
-
Proofpoint: TA4922 Deploys New RAT and Loader Arsenal
A rapidly evolving threat cluster tracked as TA4922, a Chinese-speaking cybercriminal actor deploying a diverse and expanding malware arsenal that now includes Atlas RAT, RomulusLoader, SilentRunLoader, and ValleyRAT. The group is notable for its high operational tempo, shifting tactics, and ability to blend custom malware with legitimate tools and cloud services, complicating detection efforts across…
-
ClawHub, Cisco, and Vercel Skill Detection Tools Evaded by Malicious Uploads
Security researchers have shown that AI skill security scanners from ClawHub, Cisco, and Vercel’s skills.sh can be reliably bypassed using simple techniques, raising serious concerns about agentic AI supply chain defenses. In tests conducted by Trail of Bits, multiple malicious skills designed to exfiltrate data, hijack agents, or execute arbitrary code were successfully uploaded and…
-
Payouts King Ransomware Bypasses EDR via Obfuscation and Direct Syscalls
Payouts King ransomware has emerged as a notable post-BlackBasta threat, leveraging advanced obfuscation and direct system calls to evade endpoint detection and response (EDR) solutions. Threat activity observed in early 2026 shows strong overlaps with historical BlackBasta tradecraft, particularly the use of spam bombing combined with phishing and vishing. In these campaigns, attackers overwhelm victims…
-
CrowdStrike Bets on AI Detection and Response Boom
CrowdStrike CEO George Kurtz Says Enterprises Are Seeking Controls for AI Agents. CrowdStrike says enterprise adoption of agentic AI is driving demand for AI Detection and Response, as organizations seek visibility, governance and protection against emerging AI-powered threats, non-human identities and expanding autonomous workloads. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/crowdstrike-bets-on-ai-detection-response-boom-a-31862
-
Google rolls out scam call detection for Android
First seen on scworld.com Jump to article: www.scworld.com/brief/google-rolls-out-ai-scam-call-detection-for-android
-
Attackers Use AI to Automate EDR Evasion Testing
Python scripts were used to test malware against endpoint detection and response agents from Sophos, CrowdStrike, and Windows Defender. First seen on darkreading.com Jump to article: www.darkreading.com/endpoint-security/attackers-automate-edr-evasion-testing
-
Google DoubleClick Abused in New Malspam Campaign to Deliver DesckVB RAT
Cybersecurity researchers have flagged a new malspam campaign that makes use of Google’s DoubleClick domain as a way to evade detection and ultimately deliver a remote access trojan (RAT) named DesckVB RAT.”Before the victim ever reaches attacker-controlled infrastructure, the lure routes through DoubleClick, a legitimate Google-owned domain that many security tools are less likely to…
-
Hackers Leverage AI-Powered Tools to Streamline Active Directory Compromise
A threat campaign in which attackers leveraged AI-powered tools to streamline Active Directory (AD) compromise and accelerate endpoint detection and response (EDR) evasion testing. The activity, observed on June 2, 2026, was triggered by suspicious files originating from the path C:\Users\User\Documents\test. Sophos investigation revealed a collection of malicious components forming a structured post-exploitation framework designed to…
-
New Android feature promises to spot deepfake scam calls
Android is introducing fake call detection to help protect users from impersonation scams. The feature can detect and flag suspected spoofed calls when both parties use Phone … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/06/03/android-fake-call-detection-feature/
-
Google adds a silent check to catch scammers posing as your contacts
Android is introducing fake call detection to help protect users from impersonation scams. The feature can detect and flag suspected spoofed calls when both parties use Phone … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/06/03/android-fake-call-detection-feature/
-
Critical Start expands MDR capabilities with multi-agent AI system
Critical Start has released SOC AI, a production-proven multi-agent framework powering its AI-led Managed Detection and Response (MDR). SOC AI coordinates ten specialized … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/06/03/critical-start-soc-ai/
-
Agent Threat Rules: Open detection rule format for AI agent security threats
AI agents run inside coding assistants, MCP servers, and multi-agent frameworks, and the access that makes them useful also opens paths to prompt injection, tool poisoning, … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/06/03/agent-threat-rules-ai-detection/
-
Why supply chain attacks work and what detection can actually do about it
First seen on scworld.com Jump to article: www.scworld.com/perspective/why-supply-chain-attacks-work-and-what-detection-can-actually-do-about-it
-
Fingerprint launches AI assistant detection tools
First seen on scworld.com Jump to article: www.scworld.com/brief/fingerprint-launches-ai-assistant-detection-tools
-
AI-built ransomware toolkit automates EDR evasion, AD discovery
A threat actor is using an AI-built ransomware attack toolkit that automates Active Directory discovery and helps evade endpoint detection and response (EDR) solutions. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/ai-built-ransomware-toolkit-automates-edr-evasion-ad-discovery/
-
AI-built ransomware toolkit automates EDR evasion, AD discovery
A threat actor is using an AI-built ransomware attack toolkit that automates Active Directory discovery and helps evade endpoint detection and response (EDR) solutions. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/ai-built-ransomware-toolkit-automates-edr-evasion-ad-discovery/
-
Why the browser is now the front line for AI security
AI-powered attacks and shadow AI adoption are creating new security risks inside the browser. Push Security explains why browser visibility is becoming critical for both threat detection and AI governance. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/why-the-browser-is-now-the-front-line-for-ai-security/
-
(g+) Echtzeitüberwachung: Endpoint Security neu gedacht
Endpoint-Detection-and-Response-Systeme werden zum Kern moderner Security Operations. Sie überwachen Prozesse, Identitäten und Verhalten in Echtzeit. First seen on golem.de Jump to article: www.golem.de/news/echtzeitueberwachung-endpoint-security-neu-gedacht-2606-209271.html
-
How Leading Organizations Are Turning EDR Into Operational Resilience
Most organizations now recognize that endpoint protection alone is no longer sufficient.That’s why adoption of endpoint detection and response (EDR) has accelerated rapidly in recent years. Organizations understand that modern attacks move faster, evade traditional prevention controls, and require continuous visibility into suspicious activity across the environment.But owning EDR First seen on thehackernews.com Jump to…
-
Sophos uncovers AI-powered malware lab built for EDR evasion
A threat actor used AI technologies to build a malware-testing framework for developing and refining endpoint detection and response (EDR) evasion techniques, according to … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/06/02/ai-agents-edr-evasion-techniques/
-
Iranian Hackers Hijack AppDomainManager to Bypass EDR
Iran-linked hackers have upgraded their tradecraft by using AppDomainManager hijacking in .NET applications to turn off security telemetry before malicious code fully starts, making endpoint detection and response tools much harder to spot the attack. The campaign, attributed to the Iran-nexus group Screening Serpens, pairs this technique with DLL sideloading, fake job lures, and staged…
-
Ein SOC steht in keinem Regulierungstext – Compliance braucht Detection und Response, kein SOC
First seen on security-insider.de Jump to article: www.security-insider.de/soc-mythos-nis2-dora-cra-detection-response-betriebsmodell-a-08d0a949ea491c1348d52aef22c9639e/
-
Agentisches Security-Operations-Center von Sophos verkürzt die Reaktionszeit auf Bedrohungen auf 89 Sekunden
Sophos gab Produktionsergebnisse aus einem vollständigen Jahr agentischen Betriebs von Sophos-Managed-Detection and Response (MDR) bekannt. Der Dienst schützt inzwischen weltweit 40.000 Kunden und verzeichnet ein Wachstum von 39 Prozent gegenüber dem Vorjahr. Die Ergebnisse zeigen, wie ein agentisches Security-Operations-Center (SOC) im großen Maßstab funktioniert. Telemetriedaten explodieren, IT-Stacks werden komplexer und gleichzeitig fehlen weltweit Cybersicherheitsfachkräfte. Traditionelle…
-
Lazarus APT unveils fileless remote access Trojan designed to evade detection
North Korea-linked Lazarus APT Group is using a stealthy memory-only RAT that leaves almost no forensic traces behind. North Korea-linked APT group Lazarus has never been shy about its ambitions, the threat actor has been tied to some of the most audacious financial heists in recent memory, draining hundreds of millions from cryptocurrency exchanges and…
-
Ransomware Uses ChaCha20 and Curve25519 to Encrypt Windows Files
Payload ransomware is a new Windows ransomware family that combines ChaCha20 stream encryption with per-file Curve25519 ECDH key exchange, making victim data effectively unrecoverable without the attackers’ private key. It also implements strong anti-forensics, including ETW patching, VSS deletion, event log wiping, and aggressive process/service termination to hinder detection and recovery. Payload first appeared publicly…
-
InvisibleFerret Malware Uses .pyd and .so Files to Evade Script Detection
A North Korea-linked threat group, Void Dokkaebi, also known as Famous Chollima, has significantly upgraded its malware delivery techniques by converting its Python-based InvisibleFerret malware into compiled binary modules. InvisibleFerret was previously deployed as readable Python scripts, making it easier for defenders to detect through static analysis and signature-based tools. The latest campaign leverages Cython,…
-
The Alert Firehose Finally Meets Its Match
Ask a cybersecurity pro about Network Detection and Response (NDR) and you might still hear “Noisy,” “Too much data.” But ask the teams running NDR that includes agentic AI capabilities and you’ll hear they’re actually using it to catch threats earlier, triage faster, and chase fewer false positives. The old complaint lingers in part because…