Tag: group

AWS says more than 600 FortiGate firewalls hit in AI-augmented campaign

Feb 23, 2026 1:01 PM

Tags: ai, cybercrime, firewall, group, russia, tool

Off-the-shelf tools helped Russian-speaking cybercrime group run riot First seen on theregister.com Jump to article: www.theregister.com/2026/02/23/aws_fortigate_firewalls/
Police seize 100,000 stolen Facebook credentials in cybercrime raid

Feb 23, 2026 12:01 PM

Tags: breach, credentials, cybercrime, group, organized, phishing

Officers from Poland’s Central Bureau for Combating Cybercrime (CBZC) dismantled an organized group that used phishing to seize Facebook accounts and extract BLIK payment … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/02/23/poland-cybercrime-facebook-phishing-ring/
MuddyWater Targets MENA Organizations with GhostFetch, CHAR, and HTTP_VIP

Feb 23, 2026 10:02 AM

Tags: group, hacking, iran, malware, middle-east

The Iranian hacking group known as MuddyWater (aka Earth Vetala, Mango Sandstorm, and MUDDYCOAST) has targeted several organizations and individuals mainly located across the Middle East and North Africa (MENA) region as part of a new campaign codenamed Operation Olalampo.The activity, first observed on January 26, 2026, has resulted in the deployment of new malware…
13 ways attackers use generative AI to exploit your systems

Feb 23, 2026 9:01 AM

Tags: access, ai, attack, authentication, awareness, breach, captcha, ceo, chatgpt, ciso, cloud, credentials, crypto, cyber, cyberattack, cybercrime, cybersecurity, dark-web, data, deep-fake, defense, detection, email, espionage, exploit, extortion, finance, flaw, framework, fraud, google, government, group, hacker, identity, infrastructure, intelligence, law, LLM, login, malicious, malware, marketplace, network, open-source, password, phishing, privacy, ransomware, resilience, risk, saas, scam, service, social-engineering, startup, supply-chain, tactics, technology, theft, threat, tool, vulnerability, zero-day

Facilitating malware development: AI can also be used to generate more sophisticated, or less labour-intensive, malware.For example, cybercriminals are using gen AI to create malicious HTML documents. The XWorm attack, initiated by HTML smuggling, which contains malicious code that downloads and runs the malware, bears the hallmarks of development via AI.”The loader’s detailed line-by-line description…
13 ways attackers use generative AI to exploit your systems

Feb 23, 2026 9:01 AM

Tags: access, ai, attack, authentication, awareness, breach, captcha, ceo, chatgpt, ciso, cloud, credentials, crypto, cyber, cyberattack, cybercrime, cybersecurity, dark-web, data, deep-fake, defense, detection, email, espionage, exploit, extortion, finance, flaw, framework, fraud, google, government, group, hacker, identity, infrastructure, intelligence, law, LLM, login, malicious, malware, marketplace, network, open-source, password, phishing, privacy, ransomware, resilience, risk, saas, scam, service, social-engineering, startup, supply-chain, tactics, technology, theft, threat, tool, vulnerability, zero-day

Facilitating malware development: AI can also be used to generate more sophisticated, or less labour-intensive, malware.For example, cybercriminals are using gen AI to create malicious HTML documents. The XWorm attack, initiated by HTML smuggling, which contains malicious code that downloads and runs the malware, bears the hallmarks of development via AI.”The loader’s detailed line-by-line description…
RTL Group: Hacker-Abgriff von Mitarbeiterdaten aus dem Intranet

Feb 22, 2026 5:02 AM

Tags: group, hacker

First seen on datensicherheit.de Jump to article: www.datensicherheit.de/rtl-group-hacker-abgriff-mitarbeiterdaten-intranet
7 days until ticket prices rise for TechCrunch Disrupt 2026

Feb 21, 2026 5:00 PM

Tags: group

Lowest ticket prices to TechCrunch Disrupt 2026 end February 27. Up to $680 off individual passes and up to 30% off group passes. Register before they go up to join 10,000 founders, tech operators, and VCs. First seen on techcrunch.com Jump to article: techcrunch.com/2026/02/21/7-days-until-ticket-prices-rise-for-techcrunch-disrupt-2026/
Anthropic rolls out embedded security scanning for Claude

Feb 21, 2026 12:02 AM

Tags: ai, group, update

The feature, currently limited to a small group of testers, will provide an easy-to-use feature that scans AI-generated code and offers up patching solutions. First seen on cyberscoop.com Jump to article: cyberscoop.com/anthropic-claude-code-security-automated-security-review/
Dynamic Objects in Active Directory: The Stealthy Threat

Feb 20, 2026 6:01 PM

Tags: access, attack, blueteam, breach, cloud, computer, container, control, credentials, cve, data, defense, detection, dns, endpoint, group, identity, malicious, microsoft, monitoring, password, powershell, risk, soc, strategy, threat, tool, update, vulnerability

Active Directory’s “dynamic objects” feature offers attackers a perfect evasion cloak. These objects automatically self-destruct without a trace, so they allow adversaries to bypass quotas, pollute access lists, and persist in the cloud, leaving forensic investigators with nothing to analyze. Key takeaways The threat: Dynamic objects self-delete without leaving any traces, or “tombstones” in AD…
FBI: Threats from Salt Typhoon are ‘still very much ongoing’

Feb 20, 2026 4:01 PM

Tags: china, cyber, espionage, group, infrastructure, intelligence, threat, usa

A top FBI cyber official said Salt Typhoon, the Chinese cyber espionage group behind the widespread compromise of U.S. telecommunications infrastructure in 2024, continues to pose a broad threat to both America’s private and public sectors. Michael Machtinger, deputy assistant director for cyber intelligence at the FBI, touted improved partnerships between the telecommunications industry and…
Cyberangriff: Hacker will Daten von RTL erbeutet haben

Feb 20, 2026 10:01 AM

Tags: cyberattack, group, hacker

Ein Hacker behauptet, im Besitz persönlicher Daten von über 27.000 Mitarbeitern der RTL Group zu sein. RTL untersucht den Vorfall. First seen on golem.de Jump to article: www.golem.de/news/cyberangriff-hacker-will-daten-von-rtl-erbeutet-haben-2602-205640.html
PayPal launches latest struggle to get rid of SMS for MFA

Feb 20, 2026 9:01 AM

Tags: authentication, ceo, ciso, communications, compliance, cybersecurity, email, finance, fraud, government, group, login, mfa, mobile, nfc, passkey, password, phishing, risk, service, strategy, switch, update

Muddled effort, mixed messages Flavio Villanustre, CISO for the LexisNexis Risk Solutions Group, says he’s “always found it odd” that PayPal still supports SMS as its primary secondary authentication factor.”Everyone in financial services and government has abandoned it for not being sufficiently secure and are moving to even phishing-resistant authentication, such as passkeys, Yubikeys,” he…
FBI: Threats from Salt Typhoon are ‘still very much ongoing’

Feb 19, 2026 9:01 PM

Tags: china, cyber, espionage, group, infrastructure, intelligence, threat, usa

A top FBI cyber official said Salt Typhoon, the Chinese cyber espionage group behind the widespread compromise of U.S. telecommunications infrastructure in 2024, continues to pose a broad threat to both America’s private and public sectors. Michael Machtinger, deputy assistant director for cyber intelligence at the FBI, touted improved partnerships between the telecommunications industry and…
Threat groups use AI to speed up and scale cyberattacks

Feb 19, 2026 7:01 PM

Tags: ai, breach, cyberattack, exploit, group, hacker, network, threat, vulnerability

A report from Palo Alto Networks finds hackers are increasingly using stolen identities and exploiting critical vulnerabilities within minutes of disclosure. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/threat-groups-ai-speed-scale-cyberattacks/812439/
Citizen Lab Finds Evidence of Mobile Data Extraction from Detained Kenyan Activist

Feb 19, 2026 1:01 PM

Tags: access, android, cyber, data, group, mobile, phone, technology, tool

Citizen Lab says it found forensic evidence that Cellebrite’s mobile extraction technology was used on a Samsung Android phone belonging to detained Kenyan activist and politician Boniface Mwangi while the device was in police custody in July 2025. The group warns the case highlights how high-powered forensic tools can be used to access sensitive personal…
A Busy Week for Cybersecurity Speaking Engagements

Feb 19, 2026 5:01 AM

Tags: ai, cyber, cybersecurity, data, group, incident response, technology, threat

I have a busy week with podcasts, webinars, and a keynote! Communicating and sharing is vital to the cybersecurity industry. It is how we leverage shared knowledge and experiences to make more informed decisions and gain better positions against our adversaries. Yesterday (Tuesday Feb 17th) I was speaking on Convene Chats webinar with the amazing…
Notepad++ author says fixes make update mechanism ‘effectively unexploitable’

Feb 19, 2026 1:01 AM

Tags: access, attack, backdoor, china, control, credentials, dns, espionage, exploit, group, infrastructure, intelligence, malicious, monitoring, network, risk, risk-management, service, software, supply-chain, threat, ukraine, update, vulnerability

CSOonline, Ho said that no system can ever be declared absolutely unbreakable, “but the new design dramatically raises the bar.”An attacker must now compromise both the hosting infrastructure and the signing keys, he explained, adding that the updater now validates both the manifest and the installer, each with independent cryptographic signatures. And any mismatch, missing…
Notepad++ patches flaw used to hijack update system

Feb 18, 2026 10:01 PM

Tags: apt, china, flaw, group, hacker, infrastructure, malware, update, vulnerability

Notepad++ patched a vulnerability that attackers used to hijack its update system and deliver malware to targeted users. Notepad++ fixed a vulnerability that allowed a China-linked APT group to hijack its update mechanism and selectively push malware to chosen targets. In early February, the Notepad++ maintainer revealed that nation-state hackers compromised the hosting provider’s infrastructure,…
Cybercrime Goes Corporate: Huntress Report Reveals Rise of Scalable, Stealth-First Attacks

Feb 18, 2026 7:58 PM

Tags: attack, corporate, cyber, cybercrime, exploit, group, hacker, threat

Cybercriminals are no longer lone hackers exploiting flashy zero-days; they are running streamlined, profit-driven operations that mirror legitimate businesses. That’s the key takeaway from the newly released Huntress 2026 Cyber Threat Report, which exposes how organised cybercrime groups are standardising their playbooks to maximise efficiency and revenue. Drawing on telemetry from more than 4.6 million…
Threat groups using AI to speed up and scale cyberattacks

Feb 18, 2026 5:58 PM

Tags: ai, breach, cyberattack, exploit, group, hacker, network, threat, vulnerability

A report from Palo Alto Networks finds hackers are increasingly using stolen identities and exploiting critical vulnerabilities within minutes of disclosure. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/threat-groups-ai-speed-scale-cyberattacks/812439/
China-linked hackers exploited Dell zero-day since 2024 (CVE-2026-22769)

Feb 18, 2026 4:58 PM

Tags: china, cyberespionage, exploit, flaw, group, hacker, software, zero-day

A suspected China-linked cyberespionage group has been covertly exploiting a critical zero-day flaw (CVE-2026-22769) in Dell’s RecoverPoint for Virtual Machines software since … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/02/18/exploited-dell-zero-day-cve-2026-22769-brickstorm-grimbolt/
China-linked APT weaponized Dell RecoverPoint zero-day since 2024

Feb 18, 2026 1:58 PM

Tags: apt, attack, china, exploit, flaw, google, group, intelligence, mandiant, threat, zero-day

A suspected Chinese state-linked group exploited a critical Dell RecoverPoint flaw (CVE-2026-22769) in zero-day attacks starting mid-2024. Mandiant and Google’s Threat Intelligence Group (GTIG) reported that a suspected China-linked APT group quietly exploited a critical zero-day flaw in Dell RecoverPoint for Virtual Machines starting in mid-2024. >>Mandiant and Google Threat Intelligence Group (GTIG) have identified…
Discipline is the new power move in cybersecurity leadership

Feb 18, 2026 12:58 PM

Tags: automation, cyber, cybersecurity, data, group, incident response, intelligence, metric, risk, risk-management, service, siem, soc, technology, threat, tool, update, vulnerability, vulnerability-management

How to do more with less: 1. Review contracts, renegotiate them or change the operations to a new partner Scope, service-level agreements and performance metrics should be revisited because many contracts were established under different risk profiles, urgency and pricing conditions. Modernizing contracts to focus on outcomes rather than activities, revalidating pricing and service assumptions…
Dell RecoverPoint for VMs Zero-Day CVE-2026-22769 Exploited Since Mid-2024

Feb 18, 2026 12:58 PM

Tags: china, credentials, cve, exploit, google, group, intelligence, mandiant, threat, vulnerability, zero-day

A maximum severity security vulnerability in Dell RecoverPoint for Virtual Machines has been exploited as a zero-day by a suspected China-nexus threat cluster dubbed UNC6201 since mid-2024, according to a new report from Google Mandiant and Google Threat Intelligence Group (GTIG).The activity involves the exploitation of CVE-2026-22769 (CVSS score: 10.0), a case of hard-coded credentials…
Record Number of Ransomware Victims and Groups in 2025

Feb 18, 2026 12:58 PM

Tags: cyber, group, ransomware

Searchlight Cyber reports a 30% annual increase in ransomware victim numbers in 2025 First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/record-number-ransomware-victims/
Top Security Incidents of 2025: Chrome Browser 0-Day Vulnerability Exploitation

Feb 18, 2026 11:58 AM

Tags: apt, attack, browser, chrome, control, cyber, cybersecurity, exploit, google, group, network, security-incident, vulnerability, windows, zero-day

Background In March 2025, cybersecurity researchers disclosed a highly sophisticated targeted attack campaign named “Operation ForumTroll.” Orchestrated by an unidentified state-sponsored APT group, the operation leveraged a Google Chrome 0-day vulnerability (CVE-2025-2783) as its core weapon. This vulnerability enabled sandbox escape, allowing arbitrary code execution on victims’ Windows systems and granting full control over the targeted…The…
Chinese APT Group Exploits Dell Zero-Day for Two Years

Feb 18, 2026 11:58 AM

Tags: apt, china, cve, cvss, exploit, group, mandiant, zero-day

Mandiant reveals campaign featuring exploit of a CVSS 10.0 CVE in Dell RecoverPoint for Virtual Machines First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/chinese-apt-exploits-dell-zeroday/
Riverty Group wählt Omada für skalierbare Identity Security

Feb 18, 2026 11:58 AM

Tags: fintech, governance, group, identity

Das deutsche Fintech-Unternehmen beschleunigt seine Wachstumsstrategie mit der agilen Identity-Governance-Plattform von Omada Identity First seen on infopoint-security.de Jump to article: www.infopoint-security.de/riverty-group-waehlt-omada-fuer-skalierbare-identity-security/a43752/
Zero-Day in Dell RecoverPoint Exploited by Chinese Hacker Group

Feb 18, 2026 8:58 AM

Tags: china, cve, exploit, flaw, google, group, hacker, intelligence, mandiant, threat, vulnerability, zero-day

A critical zero-day vulnerability, tracked as CVE-2026-22769, is being actively exploited in Dell Technologies’ RecoverPoint for Virtual Machines. According to Mandiant and Google Threat Intelligence Group (GTIG), the flaw carries a perfect score severity score of 10, and has been weaponized by a Chinese threat cluster, identified as UNC6201. First seen on thecyberexpress.com Jump to…
Dell 0-Day Vulnerability Targeted by Chinese Hackers Since Mid-2024 for Ongoing Malware Campaign

Feb 18, 2026 6:58 AM

Tags: china, cvss, cyber, exploit, google, group, hacker, intelligence, malware, mandiant, threat, vulnerability, zero-day

A critical zero-day vulnerability in Dell RecoverPoint for Virtual Machines has been actively exploited by Chinese state-sponsored hackers since mid-2024. Mandiant and Google Threat Intelligence Group (GTIG) attribute this campaign to UNC6201, a threat cluster with significant overlaps to the group known as Silk Typhoon. The vulnerability, tracked as CVE-2026-22769, carries a maximum CVSS score of 10.0, allowing attackers to gain…