Tag: tactics
-
Scattered Spider: Three things the news doesn’t tell you
Scattered Spider isn’t one group, it’s an identity-first threat model evolving fast. From vishing to AiTM phishing, they’re exploiting MFA gaps to hijack the cloud. Watch the Push Security webinar to learn how their identity-based tactics work, and how to stop them. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/scattered-spider-three-things-the-news-doesnt-tell-you/
-
Lyrix Ransomware Targets Windows Users with Advanced Evasion Techniques
A formidable new strain of ransomware, dubbed Lyrix, has recently surfaced, posing a significant threat to Windows users worldwide. Cybersecurity researchers have identified Lyrix as a highly advanced malicious software designed to encrypt critical files and demand substantial ransoms for decryption keys. New Threat Emerges with Sophisticated Tactics Unlike typical ransomware, Lyrix incorporates cutting-edge evasion…
-
Pro-Ukraine hacker group Black Owl poses ‘major threat’ to Russia, Kaspersky says
BO Team, also known as Black Owl, has been active since early 2024 and appears to operate independently, with its own arsenal of tools and tactics, researchers at Russian cybersecurity firm Kaspersky said. First seen on therecord.media Jump to article: therecord.media/pro-ukraine-hacker-group-black-owl-major-threat-russia
-
New PyPI Supply Chain Attacks Target Python and NPM Users on Windows and Linux
Checkmarx Zero researcher Ariel Harush has uncovered a sophisticated malicious package campaign targeting Python and NPM users across Windows and Linux platforms through typo-squatting and name-confusion attacks against popular packages. This coordinated supply chain attack demonstrates unprecedented cross-ecosystem tactics and advanced evasion techniques that security researchers warn represent an evolution in open-source threats. Cross-Ecosystem Typo-Squatting…
-
North Korean IT Workers Exploit Legitimate Software and Network Tactics to Evade EDR
A North Korean IT worker, operating under a false identity, was uncovered infiltrating a Western organization with a sophisticated remote-control system. This incident, exposed during a U.S. federal raid on a suspected laptop farm, showcases a chilling trend where adversaries leverage legitimate software and low-level network protocols to evade traditional Endpoint Detection and Response (EDR)…
-
Warning: Threat actors now abusing Google Apps Script in phishing attacks
script[.]google[.]com. The attacker is betting the user will see and trust the Google brand, and therefore trust the content.”By using a trusted platform to host the phishing page, the threat actor creates a false sense of security, obscuring the underlying threat with the goal of getting the recipient to enter their email and password without…
-
Webinar | How to Build a Platform-Based Defense Against Evolving Cyber Threats
Palo Alto Networks on How to Construct a Defense for Modern Threats. The rapid evolution of cyber threats, amplified by the integration of AI into adversarial tactics, calls for a shift in defensive strategies. Traditional approaches are no longer sufficient to address the sophistication, scale, and speed of modern attacks. First seen on govinfosecurity.com Jump…
-
PumaBot Targets Linux Devices in Latest Botnet Campaign
While the botnet may not be completely automated, it uses certain tactics when targeting devices that indicate that it may, at the very least, be semiautomated. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/pumabot-targets-linux-devices-botnet-campaign
-
Security for High Velocity Engineering
Strategy and Tactics for Protecting and Enabling Modern Software Organizations First seen on tldrsec.com Jump to article: tldrsec.com/p/security-for-high-velocity-engineering
-
UTG015 Hackers Launch Massive Brute-Force Attacks on Government Web Servers
The hacker group UTG-Q-015, first identified in December 2024 for mounting attacks on major websites like CSDN, has escalated its malicious activities, targeting government and enterprise web servers with unprecedented aggression. Initially disclosed for their tactics of website manipulation, the group has since pivoted to exploiting 0day and Nday vulnerabilities, launching widespread brute-force scanning and…
-
FBI: Silent Ransom Group Adopts Vishing Campaign Against Law Firms
The non-ransomware extortion group has switched up tactics and victimology in a deliberate and focused campaign similar to those of other attackers focused on stealing sensitive data. First seen on darkreading.com Jump to article: www.darkreading.com/endpoint-security/fbi-silent-ransom-group-vishing-law-firms
-
Researchers Uncover macOS ‘AppleProcessHub’ Stealer: TTPs and C2 Server Details Revealed
Researchers have identified a novel information-stealing malware dubbed ‘AppleProcessHub,’ designed to infiltrate Apple systems and exfiltrate sensitive user data. This discovery sheds light on an evolving threat landscape where macOS, often considered a secure platform, is increasingly becoming a target for sophisticated adversaries. The malware employs advanced tactics, techniques, and procedures (TTPs) to evade detection…
-
Feel Relieved by Perfecting Your NHI Tactics
Is Your Cybersecurity Strategy Ready for Non-Human Identities? Non-Human Identities (NHIs) and Secrets Security Management have emerged as crucial components of a comprehensive cybersecurity strategy. These powerful tools, once adequately managed, can significantly decrease the risk of security breaches and data leaks. Professionals in various sectors, including financial services, healthcare, travel, DevOps, and SOC teams,……
-
Over 40 Malicious Chrome Extensions Impersonate Popular Brands to Steal Sensitive Data
Tags: browser, chrome, cyber, cybersecurity, data, google, intelligence, malicious, phishing, tacticsCybersecurity firm LayerX has uncovered over 40 malicious Chrome browser extensions, many of which are still available on the Google Chrome Web Store. These extensions, part of three distinct phishing campaigns, were designed to impersonate well-known and trusted applications and brands. Detailed Analysis Reveals Impersonation Tactics LayerX, building off initial research by the DomainTools Intelligence…
-
The 7 unwritten rules of leading through crisis
Tags: automation, best-practice, business, ceo, cio, cyber, cybersecurity, incident response, intelligence, radius, risk, security-incident, service, software, strategy, tactics, technology, threat, tool, trainingRule 2: A proactive mindset sets the stage for collective learning: Confusion is contagious. “Providing clarity about what’s known, what matters, and what you’re aiming for, stabilizes people and systems,” says Leila Rao, a workplace and executive coaching consultant. “It sets the tone for proactivity instead of reactivity.”Simply treating symptoms will make the problem worse,…
-
Cyber threats are changing and here’s what you should watch for
In this Help Net Security video, Stefan Tanase, Cyber Intelligence Expert at CSIS, gives an overview of how cybercriminals are changing their tactics, including using … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/05/26/cyber-threats-2025-video/
-
Researchers Uncover Infrastructure and TTPs Behind ALCATRAZ Malware
Elastic Security Labs has recently exposed a sophisticated new malware family dubbed DOUBLELOADER, observed in conjunction with the RHADAMANTHYS infostealer. This discovery sheds light on the evolving tactics, techniques, and procedures (TTPs) of cybercriminals who leverage advanced obfuscation tools to hinder analysis. Notably, DOUBLELOADER is protected by ALCATRAZ, an open-source obfuscator first released in 2023,…
-
TAG-110 Hackers Deploy Malicious Word Templates in Targeted Attacks
The Russia-aligned threat actor TAG-110, also linked to UAC-0063 and APT28 (BlueDelta) with medium confidence by CERT-UA, has shifted tactics to target government, educational, and research entities in Tajikistan. According to analysis by Insikt Group from Recorded Future Report, TAG-110 has moved away from its traditional use of HTA-based payloads like HATVIBE, which it has…
-
Response to CISA Advisory (AA25-141B): Threat Actors Deploy LummaC2 Malware to Exfiltrate Sensitive Data from Organizations
AttackIQ has updated an existing assessment template in response to the CISA Advisory (AA25-141B) published on May 21, 2025, which disseminates Tactics, Techniques and Procedures (TTPs) and Indicators of Compromise (IOCs), associated with threat actors deploying the LummaC2 information stealer malware, identified through FBI investigations as recent as May 2025. First seen on securityboulevard.com Jump…