Tag: endpoint
-
GentleKiller targets more than 400 security processes across 48 products
Most ransomware operations leave the work of disabling endpoint security software to their affiliates. The ransomware-as-a-service gang Gentlemen runs a different model. Its … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/06/18/eset-gentlemen-edr-killers/
-
How security teams are getting credential visibility into developer endpoints
As we noted in our earlier analysis, attackers already know secrets are on your developers’ machines, the only question is whether security teams do. The supply chain … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/06/18/gitguardian-developer-endpoint-protection/
-
Ent Raises $100M to Reinvent Endpoint Security for AI Era
Startup Analyzes Endpoint Behavior to Stop Incidents Before Security Teams Respond. Endpoint security startup Ent emerged from stealth with a $100 million seed round led by Decibel, betting that intent-aware AI running on endpoints can prevent increasingly automated AI-driven attacks before traditional detection and response tools have time to react. First seen on govinfosecurity.com Jump…
-
Developer laptops are the credential store attackers are picking through in 2026, GitGuardian announces Endpoint Protection
New York, New York, June 16th, 2026, CyberNewswire GitGuardian is introducing Developer Endpoint Protection, extending its secrets and non-human identity (NHI) security platform coverage to developer workstations. After 12 months of supply-chain campaigns harvesting credentials from developer machines, CISOs and IT leaders are reopening a question many considered settled: what does endpoint protection have to…
-
SimpleHelp RMM flaw could give attackers full access to managed endpoints (CVE-2026-48558)
A critical vulnerability (CVE-2026-48558) in SimpleHelp, a popular remote monitoring and management (RMM) tool, can be exploited remotely by unauthenticated attackers to … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/06/16/simplehelp-rmm-cve-2026-48558/
-
Developer laptops are the credential store attackers are picking through in 2026, GitGuardian announces Endpoint Protection
New York, New York, 16th June 2026, CyberNewswire First seen on hackread.com Jump to article: hackread.com/developer-laptops-are-the-credential-store-attackers-are-picking-through-in-2026-gitguardian-announces-endpoint-protection/
-
Microsoft Defender Adds Monitoring for RPC Protocol Abuse in Cyberattacks
Tags: credentials, cyber, cyberattack, endpoint, exploit, microsoft, monitoring, threat, update, windowsMicrosoft has introduced enhanced monitoring capabilities in Microsoft Defender for Endpoint to detect and disrupt cyberattacks that abuse the Remote Procedure Call (RPC) protocol, a core Windows communication mechanism that threat actors frequently exploit for lateral movement and credential access. Announced on June 8, 2026, the update provides granular visibility into inbound remote RPC activity,…
-
Startup Geordie AI Lands $30M to Secure Enterprise AI Agents
Series A Funding Supports Visibility Across Cloud, Code and Endpoint Environments. Geordie AI, the 2026 RSAC Innovation Sandbox winner, raised $30 million in Series A funding to expand a platform that provides visibility, governance and behavioral monitoring for AI agents operating across cloud, code and endpoint environments as enterprises accelerate autonomous AI adoption. First seen…
-
Startup Geordie AI Lands $30M to Secure Enterprise AI Agents
Series A Funding Supports Visibility Across Cloud, Code and Endpoint Environments. Geordie AI, the 2026 RSAC Innovation Sandbox winner, raised $30 million in Series A funding to expand a platform that provides visibility, governance and behavioral monitoring for AI agents operating across cloud, code and endpoint environments as enterprises accelerate autonomous AI adoption. First seen…
-
Startup Geordie AI Lands $30M to Secure Enterprise AI Agents
Series A Funding Supports Visibility Across Cloud, Code and Endpoint Environments. Geordie AI, the 2026 RSAC Innovation Sandbox winner, raised $30 million in Series A funding to expand a platform that provides visibility, governance and behavioral monitoring for AI agents operating across cloud, code and endpoint environments as enterprises accelerate autonomous AI adoption. First seen…
-
Microsoft changes how Defender for Endpoint EDR updates are delivered on Windows
Microsoft will distribute Defender for Endpoint EDR updates through Microsoft Update, enabling EDR security improvements to be released independently of monthly Windows … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/06/08/microsoft-defender-for-endpoint-edr-updates/
-
The new risk equation: Why endpoint security is a financial imperative
Cyber risk is financial risk; endpoint security in financial services is a business imperative. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/spons/the-new-risk-equation-why-endpoint-security-is-a-financial-imperative/821449/
-
The new risk equation: Why endpoint security is a financial imperative
Cyber risk is financial risk; endpoint security in financial services is a business imperative. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/spons/the-new-risk-equation-why-endpoint-security-is-a-financial-imperative/821449/
-
EDRChoker Tool Abuses Windows QoS Policies to Disrupt Endpoint Security Tools
A newly disclosed red-team tool dubbed “EDRChoker” is drawing attention across the cybersecurity community for its novel approach to disrupting Endpoint Detection and Response (EDR) visibility by abusing Windows Policy-based Quality of Service (quality of service). Unlike traditional EDR evasion techniques that rely on firewall manipulation or Windows Filtering Platform (WFP) rule injection, EDRChoker operates…
-
Trend Micro Deep Security Agent Flaw Allows Repeatable Security Bypass
Trend Micro’s Deep Security Agent for Linux contains a design flaw in its behavior-monitoring stack that allows a local, unprivileged attacker to repeatedly force short “blind spots” in which endpoint protections are temporarily bypassed. The issue stems from how the agent unloads and reloads its bmhook and tmhook kernel modules under heavy local event load,…
-
SentinelOne Lays Off 8% of Staff as Internal Use of AI Grows
Frontier AI Models Accelerate Tasks Once Measured in Months to Weeks or Days. SentinelOne will cut about 240 employees, citing productivity gains from frontier AI models that have dramatically accelerated internal workflows, while redirecting savings into AI security, cloud, data and endpoint initiatives to drive long-term growth and profitability. First seen on govinfosecurity.com Jump to…
-
Payouts King Ransomware Bypasses EDR via Obfuscation and Direct Syscalls
Payouts King ransomware has emerged as a notable post-BlackBasta threat, leveraging advanced obfuscation and direct system calls to evade endpoint detection and response (EDR) solutions. Threat activity observed in early 2026 shows strong overlaps with historical BlackBasta tradecraft, particularly the use of spam bombing combined with phishing and vishing. In these campaigns, attackers overwhelm victims…
-
Attackers Use AI to Automate EDR Evasion Testing
Python scripts were used to test malware against endpoint detection and response agents from Sophos, CrowdStrike, and Windows Defender. First seen on darkreading.com Jump to article: www.darkreading.com/endpoint-security/attackers-automate-edr-evasion-testing
-
Hackers Leverage AI-Powered Tools to Streamline Active Directory Compromise
A threat campaign in which attackers leveraged AI-powered tools to streamline Active Directory (AD) compromise and accelerate endpoint detection and response (EDR) evasion testing. The activity, observed on June 2, 2026, was triggered by suspicious files originating from the path C:\Users\User\Documents\test. Sophos investigation revealed a collection of malicious components forming a structured post-exploitation framework designed to…
-
AI-built ransomware toolkit automates EDR evasion, AD discovery
A threat actor is using an AI-built ransomware attack toolkit that automates Active Directory discovery and helps evade endpoint detection and response (EDR) solutions. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/ai-built-ransomware-toolkit-automates-edr-evasion-ad-discovery/
-
AI-built ransomware toolkit automates EDR evasion, AD discovery
A threat actor is using an AI-built ransomware attack toolkit that automates Active Directory discovery and helps evade endpoint detection and response (EDR) solutions. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/ai-built-ransomware-toolkit-automates-edr-evasion-ad-discovery/
-
(g+) Echtzeitüberwachung: Endpoint Security neu gedacht
Endpoint-Detection-and-Response-Systeme werden zum Kern moderner Security Operations. Sie überwachen Prozesse, Identitäten und Verhalten in Echtzeit. First seen on golem.de Jump to article: www.golem.de/news/echtzeitueberwachung-endpoint-security-neu-gedacht-2606-209271.html
-
How Leading Organizations Are Turning EDR Into Operational Resilience
Most organizations now recognize that endpoint protection alone is no longer sufficient.That’s why adoption of endpoint detection and response (EDR) has accelerated rapidly in recent years. Organizations understand that modern attacks move faster, evade traditional prevention controls, and require continuous visibility into suspicious activity across the environment.But owning EDR First seen on thehackernews.com Jump to…
-
Sophos uncovers AI-powered malware lab built for EDR evasion
A threat actor used AI technologies to build a malware-testing framework for developing and refining endpoint detection and response (EDR) evasion techniques, according to … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/06/02/ai-agents-edr-evasion-techniques/
-
Attackers Exploit Docker, Kubernetes Misconfigs to Breach Hosts
Attackers are increasingly targeting Docker and Kubernetes environments by exploiting misconfigurations, weak isolation boundaries, and insecure APIs to compromise host systems and entire clusters. As containerization becomes the backbone of modern cloud infrastructure, threat actors are shifting focus from traditional endpoints to container ecosystems, where a single weakness can expose critical services at scale. A…
-
Iranian Hackers Hijack AppDomainManager to Bypass EDR
Iran-linked hackers have upgraded their tradecraft by using AppDomainManager hijacking in .NET applications to turn off security telemetry before malicious code fully starts, making endpoint detection and response tools much harder to spot the attack. The campaign, attributed to the Iran-nexus group Screening Serpens, pairs this technique with DLL sideloading, fake job lures, and staged…
-
Microsoft Defender can now automatically isolate hacked endpoints
Microsoft is testing a new Defender for Endpoint capability that will automatically isolate compromised endpoints to thwart attackers’ attempts to move laterally across the network. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-defender-can-now-automatically-isolate-hacked-endpoints/
-
Hackers Use CypherLoc Kit to Push Fake Microsoft Support Scams
CypherLoc is a sophisticated browser-lock scareware designed to drive victims to fraudulent tech support calls. It evades scanners and sandboxes by executing in an encrypted, condition-based manner inside the browser. Security teams should have robust anti-phishing, browser, and endpoint protections and prioritize user education. Since the start of 2026, Barracuda researchers have observed around 2.8 million…
-
PDQ Connect Adds MSP Tools for Endpoint Management
First seen on scworld.com Jump to article: www.scworld.com/news/pdq-connect-adds-msp-tools-for-endpoint-management