Tag: threat
-
WhatsApp Worm Spreads Astaroth Banking Trojan Across Brazil via Contact Auto-Messaging
Cybersecurity researchers have disclosed details of a new campaign that uses WhatsApp as a distribution vector for a Windows banking trojan called Astaroth in attacks targeting Brazil.The campaign has been codenamed Boto Cor-de-Rosa by Acronis Threat Research Unit.”The malware retrieves the victim’s WhatsApp contact list and automatically sends malicious messages to each contact to further…
-
Cisco Snort 3 Vulnerability Leading to Sensitive Data Disclosure
Cisco has disclosed two critical vulnerabilities in the Snort 3 detection engine affecting multiple enterprise security products, including firewalls, threat defense systems, and edge platforms. The vulnerabilities, tracked as CVE-2026-20026 and CVE-2026-20027 under advisory cisco-sa-snort3-dcerpc-vulns-J9HNF4tH, could allow unauthenticated remote attackers to leak sensitive information or cause denial-of-service conditions by disrupting packet inspection capabilities. The vulnerabilities…
-
React2Shell Vulnerability Hit by 8.1 Million Attack Attempts
The React Server Components (RSC) >>Flight<>React2Shell,<< has become the target of a massive exploitation campaign that shows no signs of slowing. Since the vulnerability's initial disclosure, threat intelligence firm GreyNoise has recorded over 8.1 million attack sessions, with daily attack volumes […] The post React2Shell Vulnerability Hit by 8.1 Million Attack Attempts appeared first on…
-
The Silent Scourge: A Call to Action Against Burnout in Cybersecurity
Cybersecurity headlines often focus on threat actors and attack vectors, but the quietest and most dangerous threat in cybersecurity may be within our own teams. The difficulty of detecting cyber threats is accelerating, and the volume, creativity, and effectiveness of attacks show no signs of slowing. These dynamics significantly strain cybersecurity and IT professionals, causing..…
-
Moody’s forecasts growing AI threats, regulatory friction for 2026
The U.S. and the EU continue to pursue starkly different regulatory agendas, the research firm noted. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/moodys-cyber-outlook-forecast-2026/809101/
-
Attackers Don’t Guess and Defenders Shouldn’t Either
As environments become more complex and grow, the instinctive response has been to add more tools. Organizations now manage an average of 45 cybersecurity products, which gives the impression of broad protection. Yet the organizations seeing the most meaningful reductions in breaches are the ones using continuous threat exposure management rather than those with the..…
-
China-Linked UAT-7290 Targets Telecoms with Linux Malware and ORB Nodes
A China-nexus threat actor known as UAT-7290 has been attributed to espionage-focused intrusions against entities in South Asia and Southeastern Europe.The activity cluster, which has been active since at least 2022, primarily focuses on extensive technical reconnaissance of target organizations before initiating attacks, ultimately leading to the deployment of malware families such as RushDrop First…
-
Six for 2026: The cyber threats you can’t ignore
Cybersecurity threats in 2026 are accelerating, driven by AI, automation, and more effective social engineering. Corelight outlines six emerging attack trends and explains how network visibility can help defenders respond faster. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/six-for-2026-the-cyber-threats-you-cant-ignore/
-
Phishing-Angreifer setzen vermehrt auf E-Mail-Routing-Lücken
Tags: 2fa, authentication, business, cyberattack, dmarc, dns, email, framework, infrastructure, intelligence, mail, mfa, microsoft, password, phishing, risk, service, spam, threatAngreifer missbrauchen falsch konfigurierte Richtlinien, um Phishing-E-Mails wie interne E-Mails aussehen zu lassen, Filter zu umgehen und Anmeldedaten zu stehlen.Das Threat Intelligence Team von Microsoft hat kürzlich festgestellt, dass Angreifer zunehmend komplexe E-Mail-Weiterleitungen und falsch konfigurierte Domain-Spoofing-Schutzmaßnahmen ausnutzen. Dabei lassen sie ihre Phishing-Nachrichten so aussehen, als würden sie von den angegriffenen Organisationen selbst stammen.In den…
-
UAT-7290 targets high value telecommunications infrastructure in South Asia
Talos assesses with high confidence that UAT-7290 is a sophisticated threat actor falling under the China-nexus of Advanced Persistent Threat actors (APTs). UAT-7290 primarily targets telecommunications providers in South Asia. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/uat-7290/
-
US To Leave Global Forum on Cyber Expertise
The Trump administration decided to leave 66 international organizations, including the GFCE and the European Centre of Excellence for Countering Hybrid Threats First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/us-leave-global-forum-on-cyber/
-
Maximum Severity “Ni8mare” Bug Lets Hackers Hijack n8n Servers
A newly discovered vulnerability in authentication platform n8n could allow threat actors to take control of n8n servers First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/maximum-severity-ni8mare-bug/
-
Cybercriminals Exploit VMware ESXi Vulnerabilities Using Zero-Day Toolset
Huntress security researchers have uncovered a sophisticated VMware ESXi exploitation campaign using a zero-day toolkit that remained undetected for over a year before VMware’s public disclosure. The December 2025 intrusion, which began through a compromised SonicWall VPN, demonstrates how threat actors are chaining multiple critical vulnerabilities to achieve complete hypervisor compromise. Attack Chain Begins With…
-
Cybercriminals Exploit VMware ESXi Vulnerabilities Using Zero-Day Toolset
Huntress security researchers have uncovered a sophisticated VMware ESXi exploitation campaign using a zero-day toolkit that remained undetected for over a year before VMware’s public disclosure. The December 2025 intrusion, which began through a compromised SonicWall VPN, demonstrates how threat actors are chaining multiple critical vulnerabilities to achieve complete hypervisor compromise. Attack Chain Begins With…
-
BlueDelta Hackers Target Microsoft OWA, Google, and Sophos VPN to Steal Credentials
A sophisticated credential-harvesting operation conducted by BlueDelta, a Russian state-sponsored threat group linked to the GRU’s Main Directorate, targeted critical infrastructure organizations and research institutions throughout 2025, according to a comprehensive investigation by Recorded Future’s Insikt Group. The campaign, spanning February through September 2025, represents a significant evolution in the group’s persistent credential-theft operations, with…
-
ownCloud Warns Users to Enable MFA After Credential Theft Incident
ownCloud has issued an urgent security advisory urging users to enable Multi-Factor Authentication (MFA) following a credential theft incident reported by threat intelligence firm Hudson Rock. The incident, discovered in January 2026, affected organizations using self-hosted file-sharing platforms, including some ownCloud Community Edition deployments. What Happened The incident did not result from any vulnerability or…
-
Global GoBruteforcer Botnet Campaign Threatens 50,000 Linux Servers
A sophisticated modular botnet known as GoBruteforcer is actively targeting Linux servers worldwide, with researchers estimating that more than 50,000 internet-facing servers remain vulnerable to these coordinated attacks. The threat, which has evolved significantly since its initial discovery in 2023, poses a growing danger to organizations that rely on exposed database and file-transfer services.”‹ GoBruteforcer,…
-
Holes in Veeam Backup suite allow remote code execution, creation of malicious backup config files
Tags: access, backup, credentials, cve, cvss, cybersecurity, data, exploit, jobs, malicious, monitoring, password, ransomware, remote-code-execution, risk, risk-management, sans, threat, update, veeam, vulnerabilityCVE-2025-59470 (with a CVSS score of 9) allows a Backup or Tape Operator to perform remote code execution (RCE) as the Postgres user by sending a malicious interval or order parameter;CVE-2025-59469 (with a severity score of 7.2) allows a Backup or Tape Operator to write files as root;CVE-2025-55125 (with a severity score of 7.2) allows a Backup…
-
Spanish airline Iberia attributes recent data breach claims to November incident
A spokesperson said the information relates to an incident that came to light in November, when a threat actor demanded $150,000 for allegedly stolen data. First seen on therecord.media Jump to article: therecord.media/spanish-airline-attributes-recent-breach-allegation-to-nov-incident
-
Deception Tech Snares Shiny Hunter Attacker’s IP Address
Targeted Threat Intel Firm Shares Details With Police After Honeypot Hit Getting owned by deception technology isn’t good news for one’s criminal brand or ability to remain at large. Just ask the band of young hackers behind Scattered Lapsus$ Shiny Hunters, when one of their ilk fell into a security firm’s honeytrap, revealing his actual…
-
Hackers Using Malicious QR Codes for Phishing via HTML Table
Threat actors are continuing to refine “quishing” phishing delivered through QR codes by shifting from traditional image-based payloads to “imageless” QR codes rendered directly in email HTML, a tactic designed to sidestep security tools that focus on decoding QR images. QR code abuse is not new, but it remains effective because the user experience is…
-
CrazyHunter Ransomware Targets Healthcare Sector Using Sophisticated Evasion Tactics
A sophisticated new ransomware variant, CrazyHunter, has emerged as a critical threat to the healthcare sector, employing advanced anti-malware evasion techniques and rapid network propagation that have security researchers deeply concerned. Trellix, which has been actively tracking this threat since its initial appearance, reports that the ransomware represents a significant evolution in cybercriminal tactics targeting…
-
Threat Actors Exploit Google Cloud Services to Steal Microsoft 365 Credentials
Tags: cloud, credentials, cyber, cybersecurity, email, exploit, google, infrastructure, malicious, microsoft, phishing, service, threatA sophisticated phishing campaign is exploiting Google Cloud infrastructure to bypass email security filters and steal Microsoft 365 credentials, demonstrating how attackers increasingly abuse trusted cloud platforms to lend legitimacy to their malicious activities. Cybersecurity researchers at Check Point have uncovered a large-scale operation targeting approximately 3,200 organizations, resulting in over 9,300 phishing emails over…
-
ToddyCat Malware Exploits ProxyLogon to Compromise Microsoft Exchange Servers
ToddyCat, a sophisticated cyber-espionage threat group also known as Websiic and Storm-0247, has emerged as a significant risk to organizations across Europe and Asia. The group’s operations, which began in December 2020 by targeting Microsoft Exchange servers in Taiwan and Vietnam, have since evolved into complex, multi-stage campaigns that leverage advanced evasion techniques and specialized…
-
Chinese Hackers Launch Ongoing Attacks on Taiwan’s Critical Infrastructure
China’s state-sponsored cyber operations against Taiwan have intensified dramatically, with threat actors launching an average of 2.63 million intrusion attempts daily targeting critical infrastructure across nine primary sectors, according to a newly released report from Taiwan’s National Security Bureau (NSB). The NSB report documents a concerning pattern of synchronized cyber warfare operations that correlate directly…