Tag: tactics
-
Smart Tactics for Effective Secrets Rotation
Are Your Secrets Safe? A Closer Look at Non-Human Identities and Secrets Security Management The management of Non-Human Identities (NHIs) is emerging as a pivotal component. With organizations increasingly moving operations to the cloud, the secure management of machine identities has taken on heightened significance. But what exactly are NHIs, and why do they matter?……
-
Threat Actors Advancing Email Phishing Attacks to Bypass Security Filters
Cybercriminals continue to evolve their email phishing arsenals, reviving legacy tactics while layering on advanced evasions to slip past automated filters and human scrutiny. In 2025, attackers are noted tried-and-true approaches”, like password-protected attachments and calendar invites”, with new twists such as QR codes, multi-stage verification chains, and live API integrations. These refinements not only…
-
Phishing Scams Weaponize Common Apps to Fool Users
From fake PDFs to AI voice scams, phishing attacks are evolving fast. Learn key tactics and defenses to protect against fraud, identity theft, and account loss. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/10/phishing-scams-weaponize-common-apps-to-fool-users/
-
‘I am not a robot’: Russian hackers use fake CAPTCHA lures to deploy espionage tools
Tags: access, attack, authentication, awareness, captcha, ceo, communications, control, credentials, cyber, cybersecurity, data, defense, detection, edr, email, endpoint, espionage, exploit, group, hacker, incident response, least-privilege, login, malicious, malware, mfa, monitoring, network, phishing, powershell, russia, strategy, tactics, theft, threat, tool, training, update, vulnerability, vulnerability-management, zero-trustEvolving tactics and strategies: Analysts said ColdRiver, which for years focused on credential theft and email account compromise, is shifting toward multi-stage intrusions that rely on users to execute malicious code.By using ClickFix pages that mimic CAPTCHA verification screens, the group can bypass email security filters and deliver malware directly to victims’ devices, increasing the…
-
Bitter APT Exploits WinRAR Zero-Day Through Malicious Word Files to Steal Sensitive Data
In a newly uncovered campaign, the threat group known as Bitter”, also tracked as APT-Q-37″, has leveraged both malicious Office macros and a previously undocumented WinRAR path traversal vulnerability to deliver a C# backdoor and siphon sensitive information. Researchers at Qi’anxin Threat Intelligence Center warn that this dual-pronged attack illustrates the group’s evolving tactics and…
-
Scattered Lapsus$ Hunters Signal Shift in Tactics
Scattered Lapsus$ Hunters may be preparing to launch an extortion-as-a-service model, according to Palo Alto Networks First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/scattered-lapsus-hunters-shift/
-
MITRE ATTCK is Deprecating a Tactic: 3 Takeaways from the “Defense Evasion” Break-up
MITRE ATT&CK v18 is deprecating Defense Evasion (TA0005). Learn about the new Stealth and Impair Defenses tactics and what SOC teams need to do next. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/10/mitre-attck-is-deprecating-a-tactic-3-takeaways-from-the-defense-evasion-break-up/
-
Ransomware Payouts Surge to $3.6m Amid Evolving Tactics
According to ExtraHop’s latest threat landscape report, average ransomware payments surged 44% to $3.6m in 2025 despite fewer incidents First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/ransomware-payouts-surge-dollar36m/
-
CISOs’ security priorities reveal an augmented cyber agenda
Tags: access, ai, attack, authentication, automation, awareness, business, cio, ciso, cyber, cybersecurity, data, deep-fake, detection, edr, email, framework, governance, healthcare, incident response, intelligence, malware, microsoft, mssp, phishing, ransomware, risk, service, siem, soc, software, tactics, technology, threat, tool, training, usa, vulnerability, vulnerability-management, zero-trustCSOConsequently, 41% are planning to leverage AI to detect threats, for anomaly detection, and to automate security responses. Other respondents cited plans to leverage AI for malware detection and real-time risk prediction (39%), as well as DLP and improving enterprise system visibility.Further, 40% expect to see AI enhancements as part of their existing security systems,…
-
CISOs’ security priorities reveal an augmented cyber agenda
Tags: access, ai, attack, authentication, automation, awareness, business, cio, ciso, cyber, cybersecurity, data, deep-fake, detection, edr, email, framework, governance, healthcare, incident response, intelligence, malware, microsoft, mssp, phishing, ransomware, risk, service, siem, soc, software, tactics, technology, threat, tool, training, usa, vulnerability, vulnerability-management, zero-trustCSOConsequently, 41% are planning to leverage AI to detect threats, for anomaly detection, and to automate security responses. Other respondents cited plans to leverage AI for malware detection and real-time risk prediction (39%), as well as DLP and improving enterprise system visibility.Further, 40% expect to see AI enhancements as part of their existing security systems,…
-
Why security awareness training doesn’t work, and how to fix it
Companies have built their security strategies around phishing simulations and educational webinars, tactics that research shows are ineffective. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/cybersecurity-awareness-training-research-flaws/803201/
-
âš¡ Weekly Recap: F5 Breached, Linux Rootkits, Pixnapping Attack, EtherHiding & More
It’s easy to think your defenses are solid, until you realize attackers have been inside them the whole time. The latest incidents show that long-term, silent breaches are becoming the norm. The best defense now isn’t just patching fast, but watching smarter and staying alert for what you don’t expect.Here’s a quick look at this…
-
Foreign hackers breached a US nuclear weapons plant via SharePoint flaws
Tags: access, attack, authentication, breach, china, control, corporate, cve, cyber, cybercrime, cybersecurity, data, defense, exploit, flaw, framework, government, group, hacker, identity, infrastructure, intelligence, Intruder, korea, microsoft, monitoring, network, ransomware, reverse-engineering, risk, russia, supply-chain, tactics, technology, theft, threat, vulnerability, zero-day, zero-trustChina or Russia? Conflicting attribution: Microsoft attributed the broader wave of SharePoint exploitations to three Chinese-linked groups: Linen Typhoon, Violet Typhoon, and a third actor it tracks as Storm-2603. The company said the attackers were preparing to deploy Warlock ransomware across affected systems.However, the source familiar with the Kansas City incident tells CSO that a…
-
TDL 007 – Cyber Warriors Digital Shadows: Insights from Canada’s Cybersecurity Leader
Tags: ai, awareness, backup, breach, browser, business, cio, ciso, communications, conference, control, corporate, country, cryptography, cyber, cybersecurity, dark-web, data, data-breach, defense, dns, email, encryption, finance, government, healthcare, identity, incident, infrastructure, intelligence, Internet, jobs, law, leak, linux, malicious, mfa, mitigation, network, organized, phone, privacy, ransom, ransomware, RedTeam, resilience, risk, risk-management, router, service, startup, strategy, supply-chain, switch, tactics, technology, theft, threat, tool, training, windowsSummary In this episode of The Defender’s Log, host David Redekop interviews Sami Khoury, the Senior Official for Cybersecurity for the Government of Canada. With a career spanning 33 years at the Communication Security Establishment (CSE), Khoury shares how a coincidental job application blossomed into a lifelong passion for national security. Khoury emphasizes that modern…
-
ClickFake Interview Campaign Used by Threat Actors to Deliver OtterCandy Malware
A North Korean-linked group, WaterPlum’s Cluster B, has evolved its tactics by introducing OtterCandy”, a Node.jsbased RAT and information stealer”, through the ClickFake Interview campaign, with significant enhancements observed in August 2025. This threat actor, attributed to North Korea, orchestrated two primary campaigns: Contagious Interview and ClickFake Interview. Although multiple clusters operate under the WaterPlum…
-
APT28 Deploys BeardShell and Covenant Modules via Weaponized Office Documents
Security researchers at Sekoia.io have uncovered a sophisticated cyberattack campaign orchestrated by APT28, the notorious Russian state-sponsored threat actor, targeting Ukrainian military personnel with weaponized Office documents that deliver advanced malware frameworks including BeardShell and Covenant modules. The operation represents a significant evolution in APT28’s tactics, leveraging legitimate cloud infrastructure and novel obfuscation techniques to…
-
TA585 Deploys Novel Web-Injection to Deliver MonsterV2 Malware on Windows
As cybercrime continues to evolve, new adversaries and innovative tactics challenge defenders daily. The recently emerged threat group TA585 exemplifies this shift, deploying sophisticated malware campaigns that highlight the changing nature of the cybercrime landscape. TA585’s operational strategy, infrastructure control, and malware preferences set it apart”, particularly in its use of the advanced MonsterV2 malware.…
-
TA585 Deploys Novel Web-Injection to Deliver MonsterV2 Malware on Windows
As cybercrime continues to evolve, new adversaries and innovative tactics challenge defenders daily. The recently emerged threat group TA585 exemplifies this shift, deploying sophisticated malware campaigns that highlight the changing nature of the cybercrime landscape. TA585’s operational strategy, infrastructure control, and malware preferences set it apart”, particularly in its use of the advanced MonsterV2 malware.…
-
Gladinet file sharing zero-day brings patched flaw back from the dead
What to do: All versions of CentreStack and Triofox file sharing servers up to and including 16.7.10368.56560 are vulnerable to CVE-2025-11371.The bad news is that Gladinet has yet to issue a patch for this, which means that for the time being the best customers can do is to apply the recommended mitigation.Luckily, according to Huntress,…
-
Hackers Target ScreenConnect Features For Network Intrusions
A rise in attacks exploiting RMM tools like ScreenConnect enables system control via phishing tactics First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/hackers-target-screenconnects/
-
AI and the Future of American Politics
Two years ago, Americans anxious about the forthcoming 2024 presidential election were considering the malevolent force of an election influencer: artificial intelligence. Over the past several years, we have seen plenty of warning signs from elections worldwide demonstrating how AI can be used to propagate misinformation and alter the political landscape, whether by trolls on…
-
AI and the Future of American Politics
Two years ago, Americans anxious about the forthcoming 2024 presidential election were considering the malevolent force of an election influencer: artificial intelligence. Over the past several years, we have seen plenty of warning signs from elections worldwide demonstrating how AI can be used to propagate misinformation and alter the political landscape, whether by trolls on…
-
Hackers Target macOS Users with Fake Homebrew Websites to Deliver Malicious Payloads
In September 2025, Kandji’s security researchers uncovered a sophisticated campaign in which attackers deployed multiple spoofed Homebrew installer sites that perfectly mimic the official brew.sh page. These counterfeit domains served a hidden malicious payload under the guise of the standard Homebrew installation script. This exposé delves into the tactics, infrastructure, and impact of this alarming…
-
Hackers Target macOS Users with Fake Homebrew Websites to Deliver Malicious Payloads
In September 2025, Kandji’s security researchers uncovered a sophisticated campaign in which attackers deployed multiple spoofed Homebrew installer sites that perfectly mimic the official brew.sh page. These counterfeit domains served a hidden malicious payload under the guise of the standard Homebrew installation script. This exposé delves into the tactics, infrastructure, and impact of this alarming…
-
Hackers Target macOS Users with Fake Homebrew Websites to Deliver Malicious Payloads
In September 2025, Kandji’s security researchers uncovered a sophisticated campaign in which attackers deployed multiple spoofed Homebrew installer sites that perfectly mimic the official brew.sh page. These counterfeit domains served a hidden malicious payload under the guise of the standard Homebrew installation script. This exposé delves into the tactics, infrastructure, and impact of this alarming…
-
Chinese Hackers Use Velociraptor IR Tool in Ransomware Attacks
In a new wrinkle for adversary tactics, the Storm-2603 threat group is abusing the digital forensics and incident response (DFIR) tool to gain persistent access to victim networks. First seen on darkreading.com Jump to article: www.darkreading.com/cybersecurity-operations/chinese-hackers-velociraptor-ir-tool-ransomware-attacks
-
Pro-Russia Hacktivists “Claim” Attack on Water Utility Honeypot
Forescout said that the TwoNet actor was lured into attacking a honeypot disguised as a water treatment utility, providing insights into the group’s tactics First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/russia-hacktivistsattack-water/