Tag: group
-
Major Cyber Vendors Turn to New UK Testing Program as MITRE Evaluations Face Changes
A group of cyber threat detection providers, including CrowdStrike, Palo Alto Networks and Sophos, have joined SE Labs’ PIVOT program First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/cyber-vendors-mitre-uk-testing/
-
Major Cyber Vendors Turn to New UK Testing Program as MITRE Evaluations Face Changes
A group of cyber threat detection providers, including CrowdStrike, Palo Alto Networks and Sophos, have joined SE Labs’ PIVOT program First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/cyber-vendors-mitre-uk-testing/
-
UK, US and Netherlands warn of Iranian state spyware campaign
Cyber attackers linked to Iran’s Ministry of Intelligence and Security are targeting opponents and opposition groups with Windows spyware First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366650300/UK-US-and-Netherlands-warn-over-Iranian-state-spyware-campaign
-
Major Cyber Threat Detection Vendors Shift from MITRE to UK Testing Program
A group of cyber threat detection providers, including CrowdStrike, Palo Alto Networks and Sophos, have joined SE Labs’ PIVOT program First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/cyber-vendors-mitre-uk-testing/
-
Cyber Op Targets South Korean Media & Automotive Sectors
A likely North Korean advanced persistent threat (APT) group used a previously undocumented Linux espionage toolkit to compromise load balancers, gain access to communications, and further exploit networks. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/cyber-south-korean-media-automotive
-
UK, US and Netherlands warn over Iranian state spyware campaign
Cyber attackers linked to Iran’s Ministry of Intelligence and Security are targeting opponents and opposition groups with Windows spyware First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366650300/UK-US-and-Netherlands-warn-over-Iranian-state-spyware-campaign
-
One Exploit Chain, Two Espionage Campaigns: Chrome and Windows Under Fire
Two China-linked groups ran identical Chrome/Windows zero-day exploits against NGOs, before Chrome’s patch shipped, deploying different backdoors each. Two China-linked threat actors used the same Chrome/Windows zero-day against NGOs starting September 1, 2026, Volexity’s new report lays out the whole chain in detail. On September 1, Volexity detected a spear-phishing campaign by UTA0560 targeting several…
-
Hackers Deploy Agentic AI to Automate Exploitation and Mass Credential Harvesting
Threat actors are moving from using artificial intelligence as a productivity aid to deploying autonomous agentic systems that can execute major portions of an intrusion with minimal human intervention. Google Threat Intelligence Group (GTIG) has documented a financially motivated actor that used a multi-agent framework to plan, build, and run a mass credential-harvesting operation in…
-
‘Sandworm’ Chains Cisco Vulnerabilities to Deploy Cyclops Blink
The notorious Russian threat group is spreading an upgraded version of the botnet malware, which the FBI disrupted in 2022. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/sandworm-chains-cisco-vulnerabilities-cyclops-blink
-
Iran, Yemeni Cell Used Claude in Developing Weapons, Threats: Anthropic
An Iranian-sponsored threat group and a likely Houthi engineering cell used Anthropic’s Claude and other AI tools to gather information on U.S. naval operations and to develop software for missile systems. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/iran-yemeni-cell-used-claude-in-developing-weapons-threats-anthropic/
-
Members of ‘Black Axe’ cybercriminal group extradited from South Africa
Prosecutors unsealed a 2021 indictment accusing the five men of conducting lucrative romance scams that stole thousands of dollars from more than 100 people. First seen on therecord.media Jump to article: therecord.media/members-of-black-axe-cybercrime-group-extradited-south-africa
-
Pro-Ukraine Hacking Cat group deploying new malware against Russian targets
The pro-Ukraine hacktivist group Hacking Cat has evolved from carrying out website defacements and data leaks to more sophisticated and destructive attacks on Russian targets, researchers said. First seen on therecord.media Jump to article: therecord.media/ukraine-malware-russia-ransomware
-
Cybersecurity Leaders to Watch in London: Securing Britain’s Business Capital
London hosts the head offices of insurers, payment providers, publishers, industrial groups, and consumer brands, each operating under a regulatory environment shaped by GDPR, NIS2, FCA supervision, and the UK’s evolving cyber resilience legislation. The security leaders below have built… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/cybersecurity-leaders-to-watch-in-london-securing-britains-business-capital/
-
Chicago’s CISOs to Watch: Security Leadership Citywide
Chicago has always been a city of markets, underwriters, and makers, and its security leadership reflects that mix. The CISOs below run cyber programmes at a ratings agency, a derivatives exchange, a mutual insurance group, a pharmaceutical manufacturer, and an… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/chicagos-cisos-to-watch-security-leadership-citywide/
-
Signed, Sealed, Secured: Newly Appointed CISOs to Watch
Five organisations named new security chiefs in July and August 2026: a hotel group, a physical security company, an AI data centre operator, a remittance firm, and a crypto exchange. The businesses have little in common. The CISOs they hired… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/signed-sealed-secured-newly-appointed-cisos-to-watch/
-
Hackers exploit Tencent app flaw to deploy GrayRabbit malware
Threat actors linked to a China-aligned espionage group are exploiting a critical vulnerability (CVE-2026-51990) in Tencent’s Sogou Input Method for Windows to deploy the GrayRabbit backdoor. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-exploit-tencent-app-flaw-to-deploy-grayrabbit-malware/
-
Florida says motor vehicle data breach tied to credentials stolen from officer’s personal device
The Florida Department of Motor Vehicles confirmed a data breach claimed by the cybercrime group ShinyHunters, saying it originated with the theft of credentials stored on a police officer’s personal device. First seen on therecord.media Jump to article: therecord.media/florida-shiny-hunters-motor-vehicle
-
Hackers abused Claude to extract secrets from 1.8M Android apps
Anthropic says multiple threat groups, including the financially motivated and state-sponsored espionage groups linked to Russia and China, tried to abuse its Claude AI model for malicious purposes. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-abused-claude-to-extract-secrets-from-18m-android-apps/
-
Novo Nordisk Data Breach Tied to Stolen GitHub Access Tokens
Tags: access, breach, cloud, credentials, cyber, data, data-breach, defense, exploit, extortion, github, group, infrastructureCyber Extortion Group Continues to Target Exposed Cloud-Based Data Over Endpoints. Cyber extortion group FulcrumSec continues to find hardcoded credentials in public-facing IT infrastructure and exploit them as part of what it’s dubbed a Hardcoded Horrorshow that counts Ozempic maker Novo Nordisk among its victims. Here are defenses organizations need to put in place now.…
-
Claude Used to Automate Exploitation and Data Theft Across Multiple Victims
Anthropic has warned that cybercriminals and state-sponsored hackers alike are using its Claude models for cyber attacks, weapons design, propaganda, and mass surveillance between December 2025 and August 2026.The threat actors, which the artificial intelligence (AI) company has branded Generative Threat Groups (GTGs), span state-sponsored groups, financially motivated criminals, commercial First seen on thehackernews.com Jump…
-
Russian State-Sponsored Hackers Use Claude to Rebuild Malware After Detection
Anthropic on Thursday revealed it disrupted a campaign mounted by a Russian state-sponsored threat actor that abused Claude for developing an AI-assisted workflow to get ahead of the detection curve.The operation has been attributed to a cyber espionage group it calls GTG-20006 (where “GTG” stands for Generative Threat Group), which aligns with broader reporting linking…
-
Anthropic caught Russia-linked spies using Claude in hacking operations
Anthropic detected and disrupted a Russia-linked cyber-espionage group that used its AI tool Claude in a hacking campaign targeting more than 20 government, intelligence, diplomatic and defense organizations. First seen on therecord.media Jump to article: therecord.media/anthropic-russia-hackers-claude
-
Attackers Exploit Critical Cisco FMC Flaw to deploy Qilin ransomware
Tags: access, authentication, cisco, control, credentials, cve, exploit, firewall, flaw, group, ransomware, threatThree threat groups are exploiting two Cisco FMC flaws to steal credentials, gain root access and deploy Qilin ransomware. Cisco Talos says three separate threat groups are exploiting two recently patched Secure Firewall Management Center (FMC) flaws. The main target is CVE-2026-20079, a critical authentication bypass that lets unauthenticated attackers remotely bypass security controls, run…
-
Hackers Weaponize AI Safety Guardrails to Hide Malware From LLM-Powered Security Scanners
Threat actors are adapting malware not only for conventional endpoint defenses and sandboxes, but also for large language model-powered tools increasingly used to triage suspicious code. ESET researchers linked the activity to Russia-aligned threat actor UAC-0099, which used the method during an attack against an organization in Ukraine. The group inserted a safety-sensitive, weapon-related request…
-
China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor
A China-linked hacking group exploited a flaw in Sogou Input Method, one of the most widely used tools for typing Chinese characters on Windows, to install a backdoor on victims’ computers, security company Gen Digital said in research published Thursday.The attack started with a crafted link and ended with the attacker able to do anything…
-
Hackers Abuse Claude AI Agents to Automate Cyberattacks, Exploitation and Data Theft
Threat actors increasingly deploy AI agents as operational systems for cyberattacks, moving beyond simple chatbot assistants. These AI systems automate various stages of the cyber kill chain, including reconnaissance, phishing, exploitation, persistence, and bulk data theft. Anthropic reported disrupting multiple such operations between December 2025 and August 2026, involving groups suspected to be linked to…
-
Indonesia Hit by Android Banking App-Cloning Campaign
The GoldFactory threat group exploits the Android Work Profile feature to deliver the Gigabud Trojan, while Mantax Otax spreads separately. First seen on darkreading.com Jump to article: www.darkreading.com/mobile-security/indonesia-android-banking-app-cloning-campaign
-
Anthropic details bad actors’ efforts to misuse its AI for bioweapons
Report comes two days after former employee quit claiming company’s models could cause human extinction by 2030Criminals, state-sponsored groups, spyware vendors, scientists and propagandists have attempted to use Anthropic’s powerful artificial intelligence models to design missiles and bombs, create deadly pathogens and surveil dissidents, according to a<a href=”https://www.anthropic.com/threat-intelligence-report-september-2026#biological-misuse-sep-26″> threat intelligence report the company published on…
-
Voice Callers Exploit BYOD to Reach Microsoft 365, Corporate Data
Threat actors are leveraging Microsoft’s Graph API to identify lucrative targets, then passing their access to extortion groups like ShinyHunters. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/voice-callers-exploit-byod-microsoft-365-corporate-data
-
Conti ransomware crew member sentenced to four years in prison
Oleksii Lytvynenko joined the notorious group in 2021 and was directly involved in attacks on at least 12 companies. First seen on cyberscoop.com Jump to article: cyberscoop.com/conti-ransomware-developer-sentenced/