Tag: intelligence
-
Stealthy Malware Leveraging Variable Functions and Cookies for Evasion
Cybersecurity researchers at Wordfence Threat Intelligence and their Care and Response teams have observed a persistent trend in new malware that leverages heavy obfuscation techniques to evade detection. While some malware attempts to blend in as legitimate files, the more common strategy involves sophisticated obfuscation through variable functions and cookie manipulation. This article explores this…
-
New Malware Toolkit from MuddyWater Delivers Phoenix Backdoor to Global Targets
Group-IB Threat Intelligence has uncovered a sophisticated phishing campaign orchestrated by the Iran-linked Advanced Persistent Threat group MuddyWater, targeting international organizations worldwide to gather foreign intelligence. The campaign demonstrates the threat actor’s evolving tactics and enhanced operational maturity in exploiting trusted communication channels to infiltrate high-value targets. MuddyWater launched the operation by accessing a compromised…
-
Iran-Linked MuddyWater Targets 100+ Organisations in Global Espionage Campaign
The Iranian nation-state group known as MuddyWater has been attributed to a new campaign that has leveraged a compromised email account to distribute a backdoor called Phoenix to various organizations across the Middle East and North Africa (MENA) region, including over 100 government entities.The end goal of the campaign is to infiltrate high-value targets and…
-
Open letter calls for prohibition on superintelligent AI, highlighting growing mainstream concern
An open letter released Wednesday has called for a ban on the development of artificial intelligence systems considered to be “superintelligent” until there is broad scientific consensus that such technologies can be created both safely and in a manner the public supports. The statement, issued by the nonprofit Future of Life Institute, has been signed…
-
MuddyWater Uses Compromised Mailboxes in Global Phishing Campaign
Group-IB has uncovered a phishing campaign by Iran-linked MuddyWater, exploiting compromised emails for foreign intelligence First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/muddywater-compromised-mailboxes/
-
Restructuring risk operations: building a business-aligned cyber strategy
Why organizations need a new strategy to break down silos and usher in a new era of risk intelligence First seen on theregister.com Jump to article: www.theregister.com/2025/10/21/restructuring_risk_operations_building/
-
Bitter APT Exploits WinRAR Zero-Day Through Malicious Word Files to Steal Sensitive Data
In a newly uncovered campaign, the threat group known as Bitter”, also tracked as APT-Q-37″, has leveraged both malicious Office macros and a previously undocumented WinRAR path traversal vulnerability to deliver a C# backdoor and siphon sensitive information. Researchers at Qi’anxin Threat Intelligence Center warn that this dual-pronged attack illustrates the group’s evolving tactics and…
-
CAASM and EASM: Top 12 attack surface discovery and management tools
Tags: access, ai, api, attack, automation, blockchain, business, cloud, control, corporate, credentials, cyber, cybersecurity, dark-web, data, data-breach, detection, dns, endpoint, exploit, framework, guide, hacking, HIPAA, incident response, infrastructure, intelligence, Internet, leak, marketplace, microsoft, monitoring, network, open-source, PCI, risk, risk-assessment, service, soc, software, supply-chain, technology, threat, tool, update, vulnerabilityCAASM and EASM tools for attack surface discovery and management: Periodic scans of the network are no longer sufficient for maintaining a hardened attack surface. Continuous monitoring for new assets and configuration drift are critical to ensure the security of corporate resources and customer data.New assets need to be identified and incorporated into the monitoring…
-
Russia-linked COLDRIVER speeds up malware evolution after LOSTKEYS exposure
Russia-linked COLDRIVER rapidly evolved its malware since May 2025, refining tools just days after releasing its LOSTKEYS variant, says Google. The Russia-linked hacking group COLDRIVER has been quickly upgrading its malware since May 2025, when its LOSTKEYS malware was exposed. According to Google’s Threat Intelligence Group, the hackers have been rolling out frequent updates and…
-
The Many Shapes of Identity: Inside IAM 360, Issue 3
Tags: access, ai, business, cloud, communications, compliance, container, cybersecurity, data, deep-fake, encryption, guide, iam, identity, infrastructure, intelligence, microsoft, passkey, password, risk, software, strategy, technology, threatThe Many Shapes of Identity: Inside IAM 360, Issue 3 josh.pearson@t“¦ Tue, 10/21/2025 – 17:27 The new issue of IAM 360 is here! In this issue, we take on a theme that shows how identity never stands still, reshaping how we live and work as it evolves. We call it Form Factor. Why Form Factor?…
-
Self-propagating worm found in marketplaces for Visual Studio Code extensions
Tags: access, application-security, attack, backdoor, backup, best-practice, blockchain, breach, ciso, control, credentials, crime, crypto, cyber, data, data-breach, endpoint, framework, github, gitlab, google, government, identity, incident response, infrastructure, intelligence, least-privilege, login, malicious, malware, marketplace, network, open-source, resilience, risk, sans, security-incident, software, supply-chain, threat, tool, update, wormMarketplaces targeted: The Koi Security report is the latest in a series of warnings that threat actors are increasingly targeting VS Code marketplaces in supply chain attacks. Last week, Koi Security exposed a threat actor dubbed TigerJack spreading malicious extensions. And researchers at Wiz just published research showing the widespread abuse of the OpenVSX and…
-
Google introduces agentic threat intelligence for faster, conversational threat analysis
Security teams spend much of their day pulling data from reports, forums, and feeds, trying to connect clues across multiple sources. Google says that work can now happen … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/10/21/google-agentic-threat-intelligence/
-
Veeam acquires Securiti AI for $1.7 billion
Veeam announced Tuesday it agreed to acquire Securiti AI for $1.725 billion, marking the data protection company’s largest acquisition and its entry into the artificial intelligence security market as enterprises struggle to deploy AI systems safely. The deal, expected to close in early December, comes as organizations face mounting challenges in managing data across fragmented…
-
Veeam acquires Securiti AI for $1.7 billion
Veeam announced Tuesday it agreed to acquire Securiti AI for $1.725 billion, marking the data protection company’s largest acquisition and its entry into the artificial intelligence security market as enterprises struggle to deploy AI systems safely. The deal, expected to close in early December, comes as organizations face mounting challenges in managing data across fragmented…
-
Dataminr to acquire cybersecurity firm ThreatConnect for $290 million
Dataminr, a New York-based company specializing in real-time threat intelligence, announced plans Tuesday to acquire ThreatConnect, a cybersecurity threat intelligence provider, for $290 million. The acquisition will combine Dataminr’s AI-powered analysis of public data with ThreatConnect’s internal threat management capabilities, creating what the companies describe as >>Client-Tailored intelligence
-
Dataminr to acquire cybersecurity firm ThreatConnect for $290 million
Dataminr, a New York-based company specializing in real-time threat intelligence, announced plans Tuesday to acquire ThreatConnect, a cybersecurity threat intelligence provider, for $290 million. The acquisition will combine Dataminr’s AI-powered analysis of public data with ThreatConnect’s internal threat management capabilities, creating what the companies describe as >>Client-Tailored intelligence
-
CISOs’ security priorities reveal an augmented cyber agenda
Tags: access, ai, attack, authentication, automation, awareness, business, cio, ciso, cyber, cybersecurity, data, deep-fake, detection, edr, email, framework, governance, healthcare, incident response, intelligence, malware, microsoft, mssp, phishing, ransomware, risk, service, siem, soc, software, tactics, technology, threat, tool, training, usa, vulnerability, vulnerability-management, zero-trustCSOConsequently, 41% are planning to leverage AI to detect threats, for anomaly detection, and to automate security responses. Other respondents cited plans to leverage AI for malware detection and real-time risk prediction (39%), as well as DLP and improving enterprise system visibility.Further, 40% expect to see AI enhancements as part of their existing security systems,…
-
Agentic AI security: Building the next generation of access controls
As artificial intelligence (AI) solutions continue to evolve, the rise of agentic AI”, intelligent systems that can act autonomously on behalf of an organization”, presents new … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/10/21/agentic-ai-security-access-controls/
-
Agentic AI security: Building the next generation of access controls
As artificial intelligence (AI) solutions continue to evolve, the rise of agentic AI”, intelligent systems that can act autonomously on behalf of an organization”, presents new … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/10/21/agentic-ai-security-access-controls/
-
Securing AI to Benefit from AI
Artificial intelligence (AI) holds tremendous promise for improving cyber defense and making the lives of security practitioners easier. It can help teams cut through alert fatigue, spot patterns faster, and bring a level of scale that human analysts alone can’t match. But realizing that potential depends on securing the systems that make it possible.Every organization…
-
Google Identifies Three New Russian Malware Families Created by COLDRIVER Hackers
A new malware attributed to the Russia-linked hacking group known as COLDRIVER has undergone numerous developmental iterations since May 2025, suggesting an increased “operations tempo” from the threat actor.The findings come from Google Threat Intelligence Group (GTIG), which said the state-sponsored hacking crew has rapidly refined and retooled its malware arsenal merely five days following…
-
Google Identifies Three New Russian Malware Families Created by COLDRIVER Hackers
A new malware attributed to the Russia-linked hacking group known as COLDRIVER has undergone numerous developmental iterations since May 2025, suggesting an increased “operations tempo” from the threat actor.The findings come from Google Threat Intelligence Group (GTIG), which said the state-sponsored hacking crew has rapidly refined and retooled its malware arsenal merely five days following…
-
CISOs’ security priorities reveal an augmented cyber agenda
Tags: access, ai, attack, authentication, automation, awareness, business, cio, ciso, cyber, cybersecurity, data, deep-fake, detection, edr, email, framework, governance, healthcare, incident response, intelligence, malware, microsoft, mssp, phishing, ransomware, risk, service, siem, soc, software, tactics, technology, threat, tool, training, usa, vulnerability, vulnerability-management, zero-trustCSOConsequently, 41% are planning to leverage AI to detect threats, for anomaly detection, and to automate security responses. Other respondents cited plans to leverage AI for malware detection and real-time risk prediction (39%), as well as DLP and improving enterprise system visibility.Further, 40% expect to see AI enhancements as part of their existing security systems,…
-
Securonix: Adding Threat Intelligence to the Mix
The concept of having a single suite of interconnected products, which come without the headache of installations and with optimal performance from each facet, is sometimes the best option. The other consideration is to go for a ‘best of breed’ selection of products, which may not work together and leave you with vulnerable spots even…
-
Agentic AI’s OODA Loop Problem
The OODA loop”, for observe, orient, decide, act”, is a framework to understand decision-making in adversarial situations. We apply the same framework to artificial intelligence agents, who have to make their decisions with untrustworthy observations and orientation. To solve this problem, we need new systems of input, processing, and output integrity. Many decades ago, U.S.…
-
Foreign hackers breached a US nuclear weapons plant via SharePoint flaws
Tags: access, attack, authentication, breach, china, control, corporate, cve, cyber, cybercrime, cybersecurity, data, defense, exploit, flaw, framework, government, group, hacker, identity, infrastructure, intelligence, Intruder, korea, microsoft, monitoring, network, ransomware, reverse-engineering, risk, russia, supply-chain, tactics, technology, theft, threat, vulnerability, zero-day, zero-trustChina or Russia? Conflicting attribution: Microsoft attributed the broader wave of SharePoint exploitations to three Chinese-linked groups: Linen Typhoon, Violet Typhoon, and a third actor it tracks as Storm-2603. The company said the attackers were preparing to deploy Warlock ransomware across affected systems.However, the source familiar with the Kansas City incident tells CSO that a…
-
Nordkorea setzt auf Blockchain: Staatshacker nutzen >>EtherHiding<<
Die Google Threat Intelligence Group hat eine neuartige Angriffsmethode nordkoreanischer Hacker dokumentiert. Erstmals nutzt eine staatlich geförderte Gruppe dezentrale Blockchains, um Malware-Befehle zu verschleiern eine Technik, die sich kaum unterbinden lässt. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/nordkorea-setzt-auf-blockchain-staatshacker-nutzen-etherhiding
-
AI and Patient Health Data Access: Considering the Risks
Among pressing issues facing healthcare providers and health IT vendors is how artificial intelligence enabled tools such as AI assistants might further facilitate patients’ access to records as well as the transmission of records themselves, said attorney Alisa Chestler of law firm Baker Donelson. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/interviews/ai-patient-health-data-access-considering-risks-i-5500
-
Cross-Border Phishing Attacks Spreads Across Asia
Attacks Move From China to Malaysia Using Phishing PDFs. Seemingly unrelated attacks targeting Chinese-speakers throughout the Asia-Pacific region with a remote access trojan trace back to the same threat actor, says researchers. Hackers’ most likely motivation is regional intelligence collection. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/cross-border-phishing-attacks-spreads-across-asia-a-29758
-
TDL 007 – Cyber Warriors Digital Shadows: Insights from Canada’s Cybersecurity Leader
Tags: ai, awareness, backup, breach, browser, business, cio, ciso, communications, conference, control, corporate, country, cryptography, cyber, cybersecurity, dark-web, data, data-breach, defense, dns, email, encryption, finance, government, healthcare, identity, incident, infrastructure, intelligence, Internet, jobs, law, leak, linux, malicious, mfa, mitigation, network, organized, phone, privacy, ransom, ransomware, RedTeam, resilience, risk, risk-management, router, service, startup, strategy, supply-chain, switch, tactics, technology, theft, threat, tool, training, windowsSummary In this episode of The Defender’s Log, host David Redekop interviews Sami Khoury, the Senior Official for Cybersecurity for the Government of Canada. With a career spanning 33 years at the Communication Security Establishment (CSE), Khoury shares how a coincidental job application blossomed into a lifelong passion for national security. Khoury emphasizes that modern…