Tag: tactics
-
Dire Wolf Ransomware Targets Windows, Wipes Logs and Backups
The recently emerged DireWolf ransomware group has launched a sophisticated new campaign targeting Windows systems worldwide, employing ruthless tactics to delete event logs, erase backup-related data, and thwart recovery efforts. First sighted in May 2025, DireWolf has rapidly escalated its operations, infecting 16 organizations across 16 regions”, including the United States, Thailand, Taiwan, Australia, and…
-
Dire Wolf Ransomware Targets Windows, Wipes Logs and Backups
The recently emerged DireWolf ransomware group has launched a sophisticated new campaign targeting Windows systems worldwide, employing ruthless tactics to delete event logs, erase backup-related data, and thwart recovery efforts. First sighted in May 2025, DireWolf has rapidly escalated its operations, infecting 16 organizations across 16 regions”, including the United States, Thailand, Taiwan, Australia, and…
-
Frequently Asked Questions About Chinese State-Sponsored Actors Compromising Global Networks
Tags: access, advisory, attack, authentication, china, cisa, cisco, credentials, cve, cyber, cybersecurity, data, espionage, exploit, firewall, fortinet, germany, government, identity, infrastructure, injection, ivanti, kev, malicious, microsoft, military, mitigation, mitre, network, remote-code-execution, risk, software, tactics, threat, update, vulnerability, zero-dayAn analysis of Tenable telemetry data shows that the vulnerabilities being exploited by Chinese state-sponsored actors remain unremediated on a considerable number of devices, posing major risk to the organizations that have yet to successfully address these flaws. Background Tenable’s Research Special Operations (RSO) team has compiled this blog to answer Frequently Asked Questions (FAQ)…
-
Ransom Tales: Volume III Emulating INC, Lynx and SafePay Ransomware
AttackIQ presents the third volume of Ransom Tales, an initiative focused on emulating the Tactics, Techniques, and Procedures (TTPs) exhibited by sophisticated and prominent ransomware families with the objective of empowering defenders to rigorously challenge their security controls and enhance resilience against disruptive and extortive threats. In this release, AttackIQ presents three new attack graphs…
-
DPRK Remote Work Tactics: Leveraging Code-Sharing Platforms
DPRK IT workers have leveraged popular code-sharing platforms such as GitHub, CodeSandbox, and Medium to cultivate convincing developer portfolios and land remote positions under fabricated identities. Investigations reveal approximately 50 active GitHub profiles operated by North Korean actors, supplemented by dozens of profiles across niche freelancing and forum sites. These operatives employ deepfake profile photos,…
-
Threat Actors Use Facebook Ads to Deliver Android Malware
Cybercriminals are increasingly turning their sights from desktop to mobile, exploiting Meta’s advertising platform to distribute a sophisticated Android banking trojan disguised as a free TradingView Premium app. Bitdefender Labs warns that these threat actors have shifted tactics after months of targeting Windows users with fake trading and cryptocurrency ads, now focusing worldwide on smartphone…
-
Mac Malware ‘JSCoreRunner’ Abuses Online PDF Tool to Spread
A sophisticated new Mac malware campaign has emerged that exploits users’ trust in free online PDF conversion tools, demonstrating how cybercriminals continue to evolve their tactics to bypass modern security measures. Cybersecurity firm Mosyle has exclusively disclosed the discovery of JSCoreRunner, a previously unknown Mac malware strain that achieved zero detections on VirusTotal at the…
-
New Mac Malware Dubbed >>JSCoreRunner<< Weaponizing PDF Conversion Site to Deliver Malware
A sophisticated new Mac malware campaign has emerged that exploits users’ trust in free online PDF conversion tools, demonstrating how cybercriminals continue to evolve their tactics to bypass modern security measures. Cybersecurity firm Mosyle has exclusively disclosed the discovery of JSCoreRunner, a previously unknown Mac malware strain that achieved zero detections on VirusTotal at the…
-
Organized and Criminal, Ransomware Gangs Run Up Profits
Tags: access, attack, control, cyber, extortion, group, organized, ransomware, tactics, vulnerability, vulnerability-managementRansomware attacks are rising 49% as cyber gangs evolve into organized criminal enterprises. With over 200 groups operating like corporations, recruiting talent, using RaaS models, and deploying multi-extortion tactics, defenders must strengthen foundational controls, limit vendor access, and prioritize vulnerability management to stay ahead. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/08/organized-and-criminal-ransomware-gangs-run-up-profits-2/
-
Salt Typhoon Cyber Spies Breached 80+ Nations, FBI Warns
Salt Typhoon hackers bypassed smash-and-grab tactics, infiltrating routers and surveillance systems to steal sensitive data and evade detection. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-salt-typhoon-cyber-spies-breach/
-
Microsoft warns of ransomware gang shifting to steal cloud data, lock companies out of systems
While ransomware gangs traditionally rely on deploying malware to encrypt files, a threat actor’s recent tactics show they no longer need to do that during attacks. First seen on therecord.media Jump to article: therecord.media/ransomware-gangs-shift-to-stealing-cloud-data
-
New Research Explores Emulating Scattered Spider Tactics in Real-World Scenarios
Experts have described methods for mimicking the strategies of the advanced persistent threat (APT) group Scattered Spider in a recent in-depth analysis by cybersecurity company Lares, allowing enterprises to strengthen their defenses through adversarial cooperation. Lares specializes in threat emulation, replicating real-world tactics, techniques, and procedures (TTPs) observed in cybercriminal activities. By dissecting incidents like…
-
Microsoft Unveils Storm-0501’s Cloud-Based Ransomware Deployment Tactics
Tags: backup, cloud, cyber, data, encryption, endpoint, exploit, intelligence, malware, microsoft, ransom, ransomware, tactics, threatMicrosoft Threat Intelligence has detailed the evolving tactics of the financially motivated threat actor Storm-0501, which has transitioned from traditional on-premises ransomware deployments to sophisticated cloud-based operations. Unlike conventional ransomware that relies on endpoint encryption malware and subsequent decryption key negotiations, Storm-0501 exploits cloud-native capabilities to exfiltrate massive data volumes, obliterate backups, and enforce ransom…
-
Storm-0501 Exploits Entra ID to Exfiltrate and Delete Azure Data in Hybrid Cloud Attacks
The financially motivated threat actor known as Storm-0501 has been observed refining its tactics to conduct data exfiltration and extortion attacks targeting cloud environments.”Unlike traditional on-premises ransomware, where the threat actor typically deploys malware to encrypt critical files across endpoints within the compromised network and then negotiates for a decryption key, First seen on thehackernews.com…
-
TAG-144: Actors Attacking Government Entities With New Tactics, Techniques, and Procedures
The threat actor known as TAG-144, also referred to as Blind Eagle or APT-C-36, has been linked to five distinct activity clusters operating from May 2024 through July 2025, primarily targeting Colombian government entities at local, municipal, and federal levels. This cyber threat group, active since at least 2018, employs a sophisticated blend of cyber-espionage…
-
Underground Ransomware Gang Unleashes Innovative Tactics Targeting Global Organizations
The Underground ransomware gang has been coordinating recurring attacks on enterprises throughout the globe in a worrying increase in cyber risks. They have demonstrated sophisticated malware engineering that blends cutting-edge encryption techniques with focused penetration measures. First detected in July 2023, the group resurfaced in May 2024 with a revamped Dedicated Leak Site (DLS), where…
-
New Phishing Campaign Abuses ConnectWise ScreenConnect to Take Over Devices
Abnormal AI said the campaign, which lures victims into downloading legitimate RMM software, marks a major evolution in phishing tactics First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/phishing-abuses-connectwise-take/
-
China-Based Threat Actor Mustang Panda’s TTPs Leaked
A significant milestone for cybersecurity experts is the disclosure of specific tactics, methods, and procedures (TTPs) used by Mustang Panda, an advanced persistent threat (APT) group based in China, which has illuminated their intricate activities. First observed in 2017 but potentially active since 2014, Mustang Panda is a state-sponsored actor specializing in cyber espionage, targeting…
-
New Android Trojan Variant Expands with Ransomware Tactics
A new version of the Hook Android banking Trojan features 107 remote commands, including ransomware overlays First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/android-trojan-expands-ransomware/
-
Formal Methods for Stellar DeFi: Verifying Lending Protocol with Certora Sunbeam Prover
Hello! My name is Kirill Ziborov, and I’m a formal verification engineer and security researcher at Positive Web3. From February 24 to March 18, an audit contest for the Blend protocol on the Stellar blockchain was held on the Code4rena. In addition to the traditional manual audit, the competition included a formal verification track using…
-
Beware! Fake Google Play Store Sites Used to Spread Android Malware
Cybersecurity researchers have identified a resurgence of SpyNote malware campaigns targeting Android users through sophisticated fake Google Play Store websites. The malicious actor behind these attacks has implemented new anti-analysis techniques and expanded their deceptive tactics since previous reports, demonstrating a persistent threat to mobile device security. Deceptive Campaign Hits Popular Apps The threat actor…
-
Chinese UNC6384 Hackers Use Valid Code-Signing Certificates to Evade Detection
Google Threat Intelligence Group (GTIG) has uncovered a multifaceted cyber espionage operation attributed to the PRC-nexus threat actor UNC6384, believed to be associated with TEMP.Hex (also known as Mustang Panda). This campaign, aligned with China’s strategic interests, primarily targeted diplomats in Southeast Asia alongside global entities, employing advanced tactics such as adversary-in-the-middle (AitM) attacks, captive…
-
Behind the Coinbase breach: Bribery emerges as enterprise threat
Coinbase’s widely praised incident response: Coinbase’s transparency, firm stance against the ransom, quick remediation, and willingness to compensate its customers earned wide praise from cybersecurity professionals.According to Coinbase’s Martin, the hackers resorted to paying help desk workers in India precisely because the company had built such a robust security program. Bribery, according to Martin, was…
-
Munich Reinsurance unites global security teams to boost resilience, cut costs
Tags: access, best-practice, business, cloud, conference, cyber, cybersecurity, defense, detection, edr, group, incident response, intelligence, jobs, lessons-learned, metric, network, resilience, risk, siem, skills, soc, strategy, tactics, threat, toolConsolidate functions into one incident response team, one threat intelligence team, and one threat-hunting team serving all Munich brands around the clock.Improve team capabilities by blending the strongest skills of each team into more mature, well-rounded functions.Reduce redundancies in responsibilities, tools, and processes to cut costs.To reach these goals, Munich deployed various tactics, including:Combining best…
-
IoT under siege: The return of the Mirai-based Gayfemboy Botnet
Mirai-based Gayfemboy botnet resurfaces, evolving to target systems worldwide; Fortinet researchers provided details about the new campaign. FortiGuard Labs researchers tracked a new Gayfemboy botnet campaign, the malware exploits known flaws in DrayTek, TP-Link, Raisecom, and Cisco, showing evolved tactics and renewed activity. The Gayfemboy botnet was first identified in February 2024, it borrows the…
-
BQTLOCK Ransomware-as-a-Service Emerges, Boasting Sophisticated Evasion Tactics
Ransomware-as-a-Service (RaaS) models continue to democratize sophisticated attacks in the ever-changing world of cybercrime by allowing affiliates with little technical know-how to distribute ransomware through profit-sharing or subscription models. A newly identified strain, BQTLock, has emerged since mid-July 2025, operating under this RaaS paradigm and marketed aggressively on dark web forums and Telegram channels. Overview…
-
Breach Roundup: Scattered Spider Hacker Gets 10 Years
Also: New ‘Quishing’ Tactics, Pro-Houthi Hacker Sentenced to 20 Months. This week, a Scattered Spider hacker sentenced, new squishing tricks, a pro-Houthi hacker gets 20 months in the United Kingdom, a Taiwanese web hosting provider hacked, the Business Council of New York and Ohio Medical Cannabis Center breached, North Korean hackers target Seoul and an…