Collecting Cyber-News from over 60 sources

Tag: threat

MuddyWater Launches RustyWater RAT via Spear-Phishing Across Middle East Sectors

Jan 10, 2026 1:01 PM

Tags: finance, iran, malicious, middle-east, phishing, rat, rust, spear-phishing, threat

The Iranian threat actor known as MuddyWater has been attributed to a spear-phishing campaign targeting diplomatic, maritime, financial, and telecom entities in the Middle East with a Rust-based implant codenamed RustyWater.”The campaign uses icon spoofing and malicious Word documents to deliver Rust based implants capable of asynchronous C2, anti-analysis, registry persistence, and modular First seen…
Cybercriminals Exploit Maduro Arrest News to Spread Backdoor Malware

Jan 10, 2026 7:01 AM

Tags: attack, backdoor, cyber, cybercrime, email, exploit, malicious, malware, phishing, social-engineering, spear-phishing, threat

Cybercriminals are leveraging reports of Venezuelan President NicolÃ¡s Maduro’s arrest on January 3, 2025, to distribute backdoor malware through a sophisticated social engineering campaign. Security researchers at Darktrace have uncovered a malicious operation that exploits this high-profile geopolitical event to compromise unsuspecting victims. Attack Method The threat actors likely used spear-phishing emails containing a ZIP…
Beyond “Is Your SOC AI Ready?” Plan the Journey!

Jan 9, 2026 10:01 PM

Tags: access, ai, api, automation, breach, business, ciso, compliance, control, data, detection, framework, guide, metric, mitre, siem, soar, soc, software, strategy, technology, threat, tool, training, update

You read the “AI-ready SOC pillars” blog, but you still see a lot of this: Bungled AI SOC transition How do we do better? Let’s go through all 5 pillars aka readiness dimensions and see what we can actually do to make your SOC AI-ready. #1 SOC Data Foundations As I said before, this one is my…
Hackers target misconfigured proxies to access paid LLM services

Jan 9, 2026 10:01 PM

Tags: access, hacker, LLM, service, threat

Threat actors are systematically hunting for misconfigured proxy servers that could provide access to commercial large language model (LLM) services. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-target-misconfigured-proxies-to-access-paid-llm-services/
China-Linked Hackers Exploit VMware ESXi Zero-Days to Escape Virtual Machines

Jan 9, 2026 9:02 PM

Tags: access, china, exploit, hacker, ransomware, threat, vmware, vpn, zero-day

Chinese-speaking threat actors are suspected to have leveraged a compromised SonicWall VPN appliance as an initial access vector to deploy a VMware ESXi exploit that may have been developed as far back as February 2024.Cybersecurity firm Huntress, which observed the activity in December 2025 and stopped it before it could progress to the final stage,…
Use of XMRig Cryptominer by Threat Actors Expanding: Expel

Jan 9, 2026 7:02 PM

Tags: corporate, cybersecurity, malicious, open-source, threat, tool

Security researchers last year wrote about a surge in the use by threat actors of the legitimate XMRig cryptominer, and cybersecurity firm Expel is now outlining the widening number of malicious ways they’re deploying the open-source tool against corporate IT operations. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/01/use-of-xmrig-cryptominer-by-threat-actors-expanding-expel/
xRAT Malware Targets Windows Users via Fake Adult Game

Jan 9, 2026 7:02 PM

Tags: cyber, intelligence, malicious, malware, service, threat, windows

AhnLab Security Intelligence Center (ASEC) has uncovered a dangerous distribution campaign targeting Windows users through Korean web hard services. Threat actors are leveraging xRAT (QuasarRAT) malware, disguising it as legitimate adult game content to deceive unsuspecting users into downloading and executing malicious files. Korean webhard services have become a prime vector for malware distribution, with…
50 Best Free Cyber Threat Intelligence Tools 2026

Jan 9, 2026 7:02 PM

Tags: attack, cyber, intelligence, network, threat, tool, vulnerability

Threat Intelligence Tools are more often used by security industries to test the vulnerabilities in networks and applications. It helps with the collection and analysis of information about current and potential attacks that threaten the safety of an organization or its assets. Here you can find the Comprehensive Threat Intelligence Tools list that covers Performing…
The Role of Initial Access Markets in Ransomware Campaigns Targeting Australia and New Zealand

Jan 9, 2026 7:02 PM

Tags: access, breach, cyber, data, ransomware, threat

The cyber threat environment in Australia and New Zealand has entered a critical phase throughout 2025, marked by a dramatic surge in initial access sales, sophisticated ransomware operations, and widespread data breaches affecting essential sectors. According to the Threat Landscape Report for Australia and New Zealand 2025, threat activity documented between January and November 2025…
INFORM 2026: MITRE’s Updated Threat-Informed Defense Maturity Model Explained

Jan 9, 2026 6:01 PM

Tags: defense, mitre, threat, update

On January 8th, MITRE’s Center for Threat-Informed Defense (CTID) published a significant update to INFORM, its threat-informed defense maturity model. This update reflects the joint efforts of MITRE researchers, AttackIQ, and several CTID members to enhance INFORM based on two years of operational use and broad security community feedback. First seen on securityboulevard.com Jump to…
Russian APT28 Runs Credential-Stealing Campaign Targeting Energy and Policy Organizations

Jan 9, 2026 6:01 PM

Tags: attack, credentials, russia, threat

Russian state-sponsored threat actors have been linked to a fresh set of credential harvesting attacks targeting individuals associated with a Turkish energy and nuclear research agency, as well as staff affiliated with a European think tank and organizations in North Macedonia and Uzbekistan.The activity has been attributed to APT28 (aka BlueDelta), which was attributed to…
Telecom sector sees steady rise in ransomware attacks

Jan 9, 2026 6:01 PM

Tags: attack, flaw, intelligence, ransomware, threat

A new threat intelligence report described a potent mixture of unpatched flaws and lax perimeter controls. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/telecom-ransomware-spike-cyble/809224/
PeekBoo! ðŸ«£ Emoji Smuggling and Modern LLMs FireTail Blog

Jan 9, 2026 3:01 PM

Tags: ai, computer, control, cybersecurity, data, exploit, injection, LLM, malicious, monitoring, risk, social-engineering, tactics, threat, tool, vulnerability

Jan 09, 2026 – Viktor Markopoulos – We often trust what we see. In cybersecurity, we are trained to look for suspicious links, strange file extensions, or garbled code. But what if the threat looked exactly like a smiling face sent by a colleague?Based on research by Paul Butler and building on FireTail’s previous disclosures…
PeekBoo! ðŸ«£ Emoji Smuggling and Modern LLMs FireTail Blog

Jan 9, 2026 3:01 PM

Tags: ai, computer, control, cybersecurity, data, exploit, injection, LLM, malicious, monitoring, risk, social-engineering, tactics, threat, tool, vulnerability

Jan 09, 2026 – Viktor Markopoulos – We often trust what we see. In cybersecurity, we are trained to look for suspicious links, strange file extensions, or garbled code. But what if the threat looked exactly like a smiling face sent by a colleague?Based on research by Paul Butler and building on FireTail’s previous disclosures…
CISA flags max-severity bug in HPE OneView amid active exploitation

Jan 9, 2026 2:01 PM

Tags: api, authentication, cisa, endpoint, exploit, flaw, Hardware, intelligence, kev, monitoring, software, strategy, threat, update, vulnerability

Not an ‘apply and move on’ solution: While CISA’s KEV inclusion raised the priority immediately, enterprises can’t treat OneView like a routine endpoint patch. Management-plane software is often deployed on-premises, sometimes on physical servers, and tightly coupled with production workflows. A rushed fix that breaks monitoring, authentication, or integrations can be almost as dangerous as…
World Economic Forum: Deepfake Face-Swapping Tools Are Creating Critical Security Risks

Jan 9, 2026 2:01 PM

Tags: corporate, deep-fake, risk, threat, tool

Researchers at the World Economic Forum have shown that threat actors can use commercial deepfake tools to bypass corporate security protections First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/wef-deepfake-faceswapping-security/
The Cyber Express Weekly Roundup: Schools, Hacktivists, and National Cyber Overhauls

Jan 9, 2026 1:01 PM

Tags: attack, breach, corporate, cyber, cybersecurity, government, international, threat

The opening week of 2026 has already highlighted the complexity of global cyber threats, with incidents affecting governments, educational institutions, and corporations alike. From school closures to corporate breaches and international policy shifts, cybersecurity news demonstrates that attacks are no longer confined to technical systems; they have real-world consequences for operations, public trust, and the…
China-linked UAT-7290 spies on telco in South Asia and Europe using modular malware

Jan 9, 2026 12:01 PM

Tags: attack, china, espionage, malware, network, threat

China-linked UAT-7290 has targeted South Asia and Southeastern Europe since 2022, conducting espionage and deploying RushDrop, DriveSwitch, and SilentRaid. China-linked threat actor UAT-7290 has conducted espionage attacks since at least 2022, targeting South Asia and Southeastern Europe. UAT-7290 primarily targets telecom providers, it conducts espionage by deeply embedding in victim networks and also operates Operational…
NDSS 2025 ReThink: Reveal The Threat Of Electromagnetic Interference On Power Inverters

Jan 9, 2026 10:01 AM

Tags: attack, awareness, control, cyber, Hardware, Internet, iot, network, service, software, threat, vulnerability

Session 8B: Electromagnetic Attacks Authors, Creators & Presenters: Fengchen Yang (Zhejiang University; ZJU QI-ANXIN IoT Security Joint Laboratory), Zihao Dan (Zhejiang University; ZJU QI-ANXIN IoT Security Joint Laboratory), Kaikai Pan (Zhejiang University; ZJU QI-ANXIN IoT Security Joint Laboratory), Chen Yan (Zhejiang University; ZJU QI-ANXIN IoT Security Joint Laboratory), Xiaoyu Ji (Zhejiang University; ZJU QI-ANXIN IoT…
FBI Warns North Korean Hackers Using Malicious QR Codes in Spear-Phishing

Jan 9, 2026 9:01 AM

Tags: advisory, government, hacker, malicious, north-korea, phishing, qr, spear-phishing, threat

The U.S. Federal Bureau of Investigation (FBI) on Thursday released an advisory warning of North Korean state-sponsored threat actors leveraging malicious QR codes in spear-phishing campaigns targeting entities in the country.”As of 2025, Kimsuky actors have targeted think tanks, academic institutions, and both U.S. and foreign government entities with embedded malicious Quick Response (QR) First…
New “Ghost Tap” Attack Hijacks Android Phones to Drain Bank Accounts

Jan 9, 2026 7:01 AM

Tags: android, attack, china, cyber, cybercrime, finance, group, malware, nfc, phone, technology, threat, unauthorized

Chinese threat actors are weaponizing NFC technology to steal funds from victims’ bank remotely accounts through sophisticated Android malware campaigns, with security researchers identifying at least $355,000 in fraudulent transactions from a single operation. Group-IB researchers have uncovered a sprawling cybercrime ecosystem centered around NFC-enabled Android applications that enable criminals to conduct unauthorized tap-to-pay transactions…
Cyber Retaliation Risks Rise After US-Venezuela Operation

Jan 9, 2026 1:01 AM

Tags: china, cisa, cyber, cybersecurity, infrastructure, military, risk, russia, threat

CISA Warns of Retaliatory Cyber Action From Hostile State Actors After Venezuela. Federal cybersecurity officials are warning of a likely uptick in retaliatory cyber activity from China and Russia-linked threat actors after the U.S. military raid in Venezuela, urging infrastructure operators to brace for disruptive probing and attacks. First seen on govinfosecurity.com Jump to article:…
Detect and Respond Faster with Elastic & Tines

Jan 9, 2026 1:01 AM

Tags: attack, soc, threat

Security operations center (SOC) teams are under nonstop pressure. Threats are rising, attack techniques are evolving, and analysts are drowning in alerts. Meanwhile, SOC leaders are asked to do more with fewer resources and tighter budgets. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/blogs/detect-respond-faster-elastic-tines-p-4022
New China-linked hackers breach telcos using edge device exploits

Jan 9, 2026 1:01 AM

Tags: breach, china, exploit, hacker, linux, malware, threat

A sophisticated threat actor that uses Linux-based malware to target telecommunications providers has recently broadened its operations to include organizations in Southeastern Europe. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/new-china-linked-hackers-breach-telcos-using-edge-device-exploits/
Fake AI Chrome Extensions Steal 900K Users’ Data

Jan 9, 2026 12:01 AM

Tags: ai, browser, chatgpt, chrome, data, threat

Threat actors ripped off a legitimate AI-powered Chrome extension in order to harvest ChatGPT and DeepSeek data before sending it to a C2 server. First seen on darkreading.com Jump to article: www.darkreading.com/cloud-security/fake-ai-chrome-extensions-steal-900k-users-data
VMware ESXi zero-days likely exploited a year before disclosure

Jan 8, 2026 11:01 PM

Tags: china, exploit, threat, vmware, vpn, vulnerability, zero-day

Chinese-speaking threat actors used a compromised SonicWall VPN appliance to deliver a VMware ESXi exploit toolkit that seems to have been developed more than a year before the targeted vulnerabilities became publicly known. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/vmware-esxi-zero-days-likely-exploited-a-year-before-disclosure/
CrowdStrike Acquires SGNL for $740 Million to Thwart AI-Powered Cyber Threats

Jan 8, 2026 10:02 PM

Tags: ai, credentials, crowdstrike, cyber, cybersecurity, defense, exploit, hacker, identity, intelligence, startup, technology, threat

CrowdStrike Inc. said Thursday it will acquire identity security startup SGNL in a deal valued at $740 million the latest move by the cybersecurity giant to fortify its defenses against increasingly sophisticated artificial intelligence (AI)-powered cyberattacks. The acquisition centers on SGNL’s continuous identity technology, designed to prevent hackers from exploiting user credentials as entry.. First…
Resolutions, shmesolutions (and what’s actually worked for me)

Jan 8, 2026 9:01 PM

Tags: threat

Talos’ editor ditches the pressure of traditional New Year’s resolutions in favor of practical, in-the-moment changes, and finds more success by letting go of perfection. Plus, we break down the latest on UAT-7290, a newly disclosed threat actor targeting critical infrastructure. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/resolutions-shmesolutions-and-whats-actually-worked-for-me/
The 2 faces of AI: How emerging models empower and endanger cybersecurity

Jan 8, 2026 8:02 PM

Tags: ai, api, attack, compliance, credentials, cyber, cybersecurity, data, deep-fake, defense, detection, endpoint, espionage, exploit, finance, flaw, framework, GDPR, google, governance, government, group, guide, hacker, HIPAA, incident response, injection, intelligence, LLM, malicious, malware, mandiant, microsoft, network, PCI, penetration-testing, privacy, risk, russia, scam, security-incident, service, social-engineering, strategy, tactics, threat, tool, vulnerability, zero-day

Self-modifying, evasive malware More recently, the researchers at Google Threat Intelligence Group (GTIG) identified a disturbing new trend: malware that uses LLMs during execution to dynamically alter its own behavior and evade detection. This is not pre-generated code, this is code that adapts mid-execution.In June 2025, GTIG identified an experimental malware called PROMPTFLUX, which connects…
The 2 faces of AI: How emerging models empower and endanger cybersecurity

Jan 8, 2026 8:02 PM

Tags: ai, api, attack, compliance, credentials, cyber, cybersecurity, data, deep-fake, defense, detection, endpoint, espionage, exploit, finance, flaw, framework, GDPR, google, governance, government, group, guide, hacker, HIPAA, incident response, injection, intelligence, LLM, malicious, malware, mandiant, microsoft, network, PCI, penetration-testing, privacy, risk, russia, scam, security-incident, service, social-engineering, strategy, tactics, threat, tool, vulnerability, zero-day

Self-modifying, evasive malware More recently, the researchers at Google Threat Intelligence Group (GTIG) identified a disturbing new trend: malware that uses LLMs during execution to dynamically alter its own behavior and evade detection. This is not pre-generated code, this is code that adapts mid-execution.In June 2025, GTIG identified an experimental malware called PROMPTFLUX, which connects…