Tag: group
-
NSO Spyware Pegasus Hit a Serbian University Rector Six Days Before Snap Elections
Citizen Lab confirmed Pegasus on a Serbian rector’s iPhone 6 days before elections, raising the known civil society spyware target count to 16. The Citizen Lab published a research note confirming that the iPhone of Vladan Äokić, Rector of the University of Belgrade, was infected with NSO Group’s Pegasus spyware sometime in 2026. The infection…
-
Russian GRU hackers hit NATO shipbuilder, aircraft engine maker, law enforcement agency in espionage campaign
It’s the work of the infamous group behind the attacks on Democrats during the 2016 presidential election, Symantec said. First seen on cyberscoop.com Jump to article: cyberscoop.com/russian-hackers-apt28-target-nato-defense-firms/
-
Nigerian national given 8-year sentence for tax business hacks
A Nigerian national who worked with a group to hack tax prep businesses and conduct millions of dollars in fraud using customer data was sentenced this week. First seen on therecord.media Jump to article: therecord.media/nigerian-given-8-year-sentenc-tax-hacks
-
Ransomware groups expand targeting of Palo Alto Networks vulnerability
Multiple threat actors have exploited a high-severity flaw in the company’s GlobalProtect portal. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/ransomware-targeting-palo-alto-networks-vulnerability/833474/
-
Anti-Putin messages disrupt nationwide school assessments in Russia
A pro-Ukraine group that says it operates within Russia took responsibility for anti-Putin messages appearing on an education assessment platform. Authorities said they had restored systems. First seen on therecord.media Jump to article: therecord.media/anti-putin-messages-disrupt-russian-education-platform
-
Best Cybersecurity Thought Leadership Agencies
The best cybersecurity thought leadership agencies help organisations turn expert insight into credible executive content, original research and influential industry commentary. For technical, practitioner-led thought leadership: Bora combines cybersecurity content expertise with a team that includes former security practitioners. For research-led programmes: CyberEdge Group and 10Fold offer examples of turning cybersecurity data into substantial reports…
-
Pegasus Spyware Infection Confirmed on Serbian University Rector’s iPhone Days Before Election
The iPhone of Vladan Äokić, rector of the University of Belgrade and a prominent supporter of Serbia’s student protest movement, was infected with NSO Group’s Pegasus spyware in 2026, the Citizen Lab said on October 19.The finding came six days before Serbia’s October 25 snap parliamentary election. The infection used a zero-click exploit, meaning Äokić…
-
Scammers Turn Legitimate Fintech Platforms Into Phishing Tools to Steal Banking Details
Scammers have weaponized a legitimate spend-management platform to send phishing messages and validate stolen financial credentials, turning trusted payment infrastructure into an operational part of fraud instead of attacking it directly. Group-IB documented the activity within a client environment after the platform reported suspicious payment notifications in late April 2026. According to the supplied research,…
-
Defense contractors in two NATO allies hacked in recent Russia-linked campaign
The Russian group known as APT28 and Fancy Bear used a recently documented backdoor to dwell in the networks of two defense contractors and a law enforcement agency in two NATO allies, researchers said. First seen on therecord.media Jump to article: therecord.media/european-defense-contractors-fancy-bear-espionage
-
FBI Uncovers Suspected Links Between Ransomware Negotiators and ShinyHunters Hackers
Federal investigators examining the ShinyHunters group have uncovered potential connections between the extortion group and executives at two ransomware negotiation firms, according to a KrebsOnSecurity investigation published on October 19. Sources familiar with the inquiry revealed that an executive from an unnamed U.S. consulting company allegedly assisted in operating the group’s victim extortion website. This…
-
Judge denies WhatsApp’s bid to hold spyware maker in contempt for allegedly targeting users
WhatsApp argued that NSO Group violated a 2025 injunction against using the messaging app to spread spyware. A federal judge said WhatsApp hurt its case by not revealing enough information. First seen on therecord.media Jump to article: therecord.media/whatsapp-denied-appeal-alleged-nso-group-violation-injunction
-
The power of AI is worrying senior Labour figures as is the fear of ‘falling behind the public’
Westminster appears to be waking up to warnings over AI safety, with concerns over its use by extremist groups and bad actors”I have this sense that, within a few months, AI is going to be all anyone is talking about,” said one cabinet minister, with an ominous stare.It was Labour conference, with everyone from ministers…
-
Prolific Chinese espionage group exploits BeyondTrust zero-day
Researchers said the first known attack by Armory Castle, also known as UNC5221, occurred almost seven weeks ago. The threat group previously compromised Ivanti and Citrix customers. First seen on cyberscoop.com Jump to article: cyberscoop.com/china-espionage-attacks-beyondtrust-zero-day-armory-castle/
-
Attackers Tampered with AOMEI Backupper’s Update Servers for Minutes to Deliver a Backdoor
Attackers repeatedly changed the files that AOMEI Backupper fetches from the vendor’s own update servers, in windows of five to ten minutes at a time between May and July 2026, so that any copy of the Windows backup program that checked for an update during one of those windows would download and run a backdoor.Google…
-
Zero-Day in BeyondTrust Remote Support Appliances Exploited
‘Patch ASAP’ Before Fix Gets Reverse-Engineered by Other Attackers, Expert Warns. All self-hosted BeyondTrust Remote Support appliance users are being urged to immediately patch a bug that an advanced persistent threat group tied to China, which specializes in hacking edge devices. Its been exploiting since late August as a zero-day vulnerability to steal credentials and…
-
Moscow police detain suspected DataSuckers hackers linked to breaches in Ukraine and Russia
Russian authorities have reportedly detained three suspected members of the DataSuckers hacking group following a cyberattack on a popular restaurant chain that exposed vast amounts of customer information. First seen on therecord.media Jump to article: therecord.media/russia-datasuckers-hackers-arrested
-
Moscow police detain suspected DataSuckers hackers linked to breaches in Ukraine and Russia
Russian authorities have reportedly detained three suspected members of the DataSuckers hacking group following a cyberattack on a popular restaurant chain that exposed vast amounts of customer information. First seen on therecord.media Jump to article: therecord.media/russia-datasuckers-hackers-arrested
-
Moscow police detain suspected DataSuckers hackers linked to breaches in Ukraine and Russia
Russian authorities have reportedly detained three suspected members of the DataSuckers hacking group following a cyberattack on a popular restaurant chain that exposed vast amounts of customer information. First seen on therecord.media Jump to article: therecord.media/russia-datasuckers-hackers-arrested
-
Suspected Chinese espionage attackers abusing BeyondTrust IT support zero-day
An alleged Chinese state-backed group is using a new zero-day affecting BeyondTrust IT support software to conduct espionage attacks. First seen on therecord.media Jump to article: therecord.media/beyond-trust-cyberattack-china
-
MITRE ATTCK v20 Adds New AI Attack Techniques for Prompt Injection and Data Theft
MITRE released ATT&CK v20 on October 13, 2026. It adds the first Enterprise techniques for direct and indirect prompt injection, AI-enabled exfiltration and AI result poisoning. MITRE ATT&CK v20 Adds New AI Attack Techniques According to updates published by MITRE, the release updates Techniques, Groups, Campaigns and Software across the Enterprise, Mobile and ICS domains.…
-
China Espionage Actor Actively Targeting Critical BeyondTrust Flaw, Google Warns
The suspected PRC-aligned group Armory Castle has been observed exploiting the newly disclosed flaw for long-term persistence First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/china-actor-beyondtrust-flaw-google/
-
Hackers Exploit BeyondTrust Zero-Day and Erase Security Logs to Hide Their Tracks
A suspected China-nexus espionage group exploited a critical zero-day in BeyondTrust Remote Support, tracked as CVE-2026-102764. It then deleted logs to hide its activity. BeyondTrust patched the flaw in advisory BT26-05 and disclosed it on October 15, 2026, alongside a Mandiant analysis. BeyondTrust zero-day According to research published by BeyondTrust, the actor exploited the vulnerability…
-
China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers
The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remote Support (formerly Bomgar) as a zero-day in late August 2026.The vulnerability, tracked as CVE-2026-102764 (CVSS score: 9.3), is a case of improper origin validation in an internal messaging component that could be…
-
Google Warns Chinese Hackers Exploited Critical BeyondTrust Zero-Day to Gain Root Access
A suspected China-linked espionage group exploited a critical BeyondTrust Remote Support vulnerability as a zero-day in late August 2026 weeks before BeyondTrust disclosed it on October 15. Mandiant, which investigated the incident, found the attackers used the flaw to upload a file, then built a path from an unprivileged web service account to root access,…
-
Silent Lynx: Kazakhstan-Linked Hackers Target Russian Refinery and Government
Silent Lynx, a group likely based in Kazakhstan, targets Russian energy and government entities in espionage campaigns across Central Asia. Researchers from Cisco Talos and Recorded Future published a detailed paper on a threat actor they call Silent Lynx (aka UAT-6275, TAG-193), a Kazakhstan nexus group conducting espionage across Central Asia. The targets include the…
-
Citrix Patches XenServer Vulnerabilities That Could Enable Host Compromise
Citrix has released security updates for XenServer 8.4 and XenServer 9. The updates fix several vulnerabilities, three of which could let a malicious privileged guest VM user compromise or crash the underlying host. Cloud Software Group rated the bulletin High severity. Citrix XenServer vulnerabilities According to the advisory published by Citrix on October 13, 2026…
-
AI-generated changes create review bottlenecks in software delivery
83.4% of respondents who use DevOps practices run CI/CD pipelines, making them the most widely adopted practice in that group, according to JetBrains’ The State of CI/CD in … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/15/jetbrains-ai-software-delivery-report/
-
FBI raids DPRK IT worker laptop farms in Texas, US nationals arrested
The U.S. Department of Justice (DoJ) has disrupted the Famous Chollima threat group’s operations by arresting two suspects, charging 14 individuals, and seizing nearly 187 laptops used in North Korean remote IT worker schemes. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/fbi-raids-dprk-it-worker-laptop-farms-in-texas-us-nationals-arrested/