Tag: threat
-
eScan Antivirus Update Server Breached to Deliver Malicious Software Updates
MicroWorld Technologies’ eScan antivirus platform fell victim to a sophisticated supply chain attack on January 20, 2026, when threat actors compromised legitimate update infrastructure to distribute multi-stage malware to enterprise and consumer endpoints worldwide. Security researchers immediately alerted the vendor, which isolated the affected infrastructure within one hour and took its global update system offline…
-
Python-Based PyRAT Emerges as Cross-Platform Threat With Advanced Remote Access Capabilities
In the evolving landscape of cyber threats, attackers increasingly leverage Python to develop sophisticated Remote Access Trojans (RATs) that evade traditional security controls. Python’s widespread adoption and cross-platform compatibility make it an attractive development platform for threat actors seeking to maximize their reach. Unlike compiled binaries, Python-based malware compiled into ELF and PE formats poses…
-
Long-running North Korea threat group splits into 3 distinct operations
The trio, which share lineage with the more broadly defined Lazarus Group, are focused on espionage and cryptocurrency theft, according to CrowdStrike. First seen on cyberscoop.com Jump to article: cyberscoop.com/north-korea-labyrinth-chollima-splits-crowdstrike/
-
Nation-state and criminal actors leverage WinRAR flaw in attacks
Multiple threat actors exploited a now-patched critical WinRAR flaw to gain initial access and deliver various malicious payloads. Google Threat Intelligence Group (GTIG) revealed that multiple threat actors, including APTs and financially motivated groups, are exploiting the CVE-2025-8088 flaw in RARLAB WinRAR to establish initial access and deploy a diverse array of payloads. The WinRAR…
-
QA: Why Cybersecurity Is Now a Core Business Risk, Not Just a Technical Problem
Tags: attack, business, cyber, cybersecurity, data, government, infrastructure, resilience, risk, supply-chain, threatCybersecurity threats are escalating in scale and sophistication, and organisations around the world are scrambling to keep pace with the evolving digital risk landscape. Governments and corporations alike face increasing pressure to strengthen cyber resilience as attacks extend across critical infrastructure, supply chains and data systems with growing frequency. At the forefront of national and…
-
EU’s answer to CVE solves dependency issue, adds fragmentation risks
Tags: access, ai, china, cisco, cve, cyber, cybersecurity, data, dos, exploit, finance, governance, grc, infrastructure, intelligence, international, nvd, open-source, risk, service, software, threat, tool, vulnerability, vulnerability-managementCoordinated disclosure: Nik Kale, principal engineer and product architect at Cisco Systems, says GCVE’s main challenge comes from building a platform that the security community can rely on for coordinated disclosure and remediation.”Viability depends far more on governance than on the data itself,” Kale says. “That includes clear attribution rules, transparent CNA processes, predictable decision-making,…
-
NSFOCUS Unveils Enhanced AI LLM Risk Threat Matrix for Holistic AI Security Governance
SANTA CLARA, Calif., Jan 29, 2026 Security is a prerequisite for the application and development of LLM technology. Only by addressing security risks when integrating LLMs can businesses ensure healthy and sustainable growth. NSFOCUS first proposed the AI LLM Risk Threat Matrix in 2024. The Matrix addresses security from multiple perspectives: foundational security, data security,…The…
-
NIST’s AI guidance pushes cybersecurity boundaries
Tags: access, ai, ciso, control, cybersecurity, data, defense, exploit, framework, intelligence, nist, risk, risk-assessment, software, threatThe limits of ‘AI is just software’: NIST’s instinct to frame AI as an extension of traditional software allows organizations to reuse familiar concepts, risk assessment, access control, logging, defense in depth, rather than starting from zero. Workshop participants repeatedly emphasized that many controls do transfer, at least in principle.But some experts argue that the…
-
NDSS 2025 Recurrent Private Set Intersection For Unbalanced Databases With Cuckoo Hashing
Session 10C: Privacy Preservation Authors, Creators & Presenters: Eduardo Chielle (New York University Abu Dhabi), Michail Maniatakos (New York University Abu Dhabi) PAPER Recurrent Private Set Intersection for Unbalanced Databases with Cuckoo Hashing and Leveled FHE A Private Set Intersection (PSI) protocol is a cryptographic method allowing two parties, each with a private set, to…
-
SolarWinds, again: Critical RCE bugs reopen old wounds for enterprise security teams
Tags: access, attack, authentication, awareness, breach, cisco, control, credentials, cve, cybersecurity, data, exploit, flaw, fortinet, infrastructure, malicious, programming, radius, rce, remote-code-execution, software, threat, update, vulnerabilityRemote code execution and data deserialization vulnerabilities CVE-2025-40551 (critical) and CVE-2025-40553 (critical);Authentication and bypass security flaws CVE-2025-40552 (critical), CVE-2025-40554 (critical), CVE-2025-40536 (high), and CVE-2025-40537 (high).CVE-2025-40551 and CVE-2025-40553 make WHD susceptible to untrusted data deseralization that could allow attackers to run commands on the host machine. The flaw could be exploited without authentication.The other two critical…
-
Crooks are hijacking and reselling AI infrastructure: Report
Tags: access, ai, api, attack, authentication, business, cloud, communications, control, credentials, cybersecurity, data, data-breach, endpoint, exploit, firewall, group, infosec, infrastructure, intelligence, Internet, LLM, malicious, marketplace, risk, service, skills, technology, theft, threat, training, vulnerabilityexposed endpoints on default ports of common LLM inference services;unauthenticated API access without proper access controls;development/staging environments with public IP addresses;MCP servers connecting LLMs to file systems, databases and internal APIs.Common misconfigurations leveraged by these threat actors include:Ollama running on port 11434 without authentication;OpenAI-compatible APIs on port 8000 exposed to the internet;MCP servers accessible without…
-
Hackers Still Using Patched WinRAR Flaw for Malware Drops, Warns Google
The Google Threat Intelligence Group (GTIG) warns that nation-state actors and financially motivated threat actors are exploiting a… First seen on hackread.com Jump to article: hackread.com/hackers-patch-winrar-flaw-malware-google/
-
Stop Staring at JSON: How GenAI is Solving the API >>Context Crisis<<
Tags: ai, api, attack, authentication, banking, business, credentials, credit-card, data, endpoint, governance, mobile, organized, risk, soc, threat, toolThere is a moment that happens in every SOC (Security Operations Center) every day. An alert fires. An analyst looks at a dashboard and sees a UR: POST /vs/payments/proc/77a. And then they stop. They stare. And they ask the question that kills productivity: “What does this thing actually do?” Is it a critical payment gateway?…
-
Wie Ransomware-Gruppen ihre Opfer auswählen
Die Sophos-X-Ops-Counter-Threat-Unit (CTU) untersucht in einer neuen Studie, wie Ransomware-Akteure ihre Ziele auswählen. Das Ergebnis macht einmal mehr klar, dass die Cyberkriminelle gerne den Weg des geringsten Widerstands gehen: die überwiegende Mehrheit der untersuchten Ransomware-Angriffe erfolgte opportunistisch und nicht gezielt. Die Analyse der CTU-Telemetriedaten belegt, dass Angreifer in den meisten Fällen ihre vorhandenen Zugriffsrechte ausnutzen,…
-
Data Privacy Day and Change Your Password Day
Data Privacy Day and Change Your Password Day arrive at a time when privacy concerns have shifted from niche technical debates to everyday business and personal risk. As digital services expand and data becomes increasingly distributed, the threat to privacy grows. Identity compromise, human behaviour and loss of data control now sit at the heart…
-
Smarter Security, Smaller Teams: Building Resilience with Limited Resources
Security teams are being asked to manage enterprise-scale threats with fewer tools, fewer analysts, and tighter budgets. Discover how high-performing SOCs are building clarity-driven, resilience-focused programs that scale without alert overload, burnout, or runaway complexity. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/security/smarter-security-smaller-teams-building-resilience-with-limited-resources/
-
eSkimming Attacks Surge with Evolving Tactics and Ongoing Recovery Challenges
A new longitudinal study of Magecart-style eSkimming attacks overturns the assumption that discovery equals recovery. Instead of being a one-time incident that ends with script removal, eSkimming is emerging as a long-lived, shape”‘shifting threat that lingers on previously compromised sites and often returns in new forms. Over the course of a year, researchers tracked 550…
-
Cybercriminals Leverage AI-Generated Malicious Job Offers to Spread PureRAT Malware
A Vietnamese threat actor is using AI-authored code to power a phishing campaign that delivers the PureRAT malware and related payloads, leveraging realistic job-themed lures to compromise corporate systems. The campaign, first documented by Trend Micro in December 2025, initially used malicious ZIP and RAR attachments posing as job opportunity documents. More recent activity observed…
-
Cybercriminals Exploit Canadians’ Dependence on Digital Services in Widespread Attacks
Canadian citizens are facing a coordinated phishing campaign that leverages government impersonation and brand spoofing to harvest personal and financial data at scale. The campaign is heavily aligned with PayTool, a known phishing-as-a-service ecosystem specializing in traffic violation scams targeting Canadians via SMS. Beyond traffic fines, threat actors are impersonating Canada Revenue Agency (CRA), Air…
-
WhatsApp Introduces New Strict Account Settings to Protect Users from Hackers
WhatsApp has unveiled Strict Account Settings, an advanced security feature designed to shield high-risk users from sophisticated cyber threats and targeted attacks. The lockdown-style protection mechanism provides enhanced safeguards for journalists, public figures, activists, and other individuals who may face elevated cybersecurity risks. Enhanced Protection Against Sophisticated Threats The new feature implements multiple restrictive security…
-
UK leaders warned country risks ‘absorbing’ cyber and hybrid attacks without offensive deterrence
The government must do more to actively disrupt and deter foreign cyber and hybrid threats, U.K. ministers were told at at a parliamentary hearing. First seen on therecord.media Jump to article: therecord.media/uk-government-warned-cyber-hybrid-threats-offensive-operations
-
From Triage to Threat Hunts: How AI Accelerates SecOps
If you work in security operations, the concept of the AI SOC agent is likely familiar. Early narratives promised total autonomy. Vendors seized on the idea of the “Autonomous SOC” and suggested a future where algorithms replaced analysts.That future has not arrived. We have not seen mass layoffs or empty security operations centers. We have…
-
Mustang Panda Deploys Updated COOLCLIENT Backdoor in Government Cyber Attacks
Threat actors with ties to China have been observed using an updated version of a backdoor called COOLCLIENT in cyber espionage attacks in 2025 to facilitate comprehensive data theft from infected endpoints.The activity has been attributed to Mustang Panda (aka Earth Preta, Fireant, HoneyMyte, Polaris, and Twill Typhoon) with the intrusions primarily directed against government…
-
Trust At Scale: The Commons, Threats, and AI in the Loop – Sonatype
<div cla Dependency management used to be a private embarrassment: an Ant script, a /lib folder, and classpath roulette. You could ship anyway, and the consequences mostly stayed inside your org. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/01/trust-at-scale-the-commons-threats-and-ai-in-the-loop-sonatype/
-
AI Security Threats Loom as Enterprise Usage Jumps 91%
Zscaler analysts found critical vulnerabilities in 100% of enterprise AI systems, with 90% compromised in under 90 minutes First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/ai-security-threats-loom-zscaler/
-
New WhatsApp lockdown feature protects high-risk users from hackers
Meta has started rolling out a new WhatsApp lockdown-style security feature designed to protect journalists, public figures, and other high-risk individuals from sophisticated threats, including spyware attacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/whatsapp-gets-new-lockdown-feature-that-blocks-cyberattacks/
-
Google Warns of Active Exploitation of WinRAR Vulnerability CVE-2025-8088
Google on Tuesday revealed that multiple threat actors, including nation-state adversaries and financially motivated groups, are exploiting a now-patched critical security flaw in RARLAB WinRAR to establish initial access and deploy a diverse array of payloads.”Discovered and patched in July 2025, government-backed threat actors linked to Russia and China as well as financially motivated First…
-
Researchers Uncover 454,000+ Malicious Open Source Packages
Sonatype warns that open source threats became industrialized with a surge in malicious packages in 2025 First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/454000-malicious-open-source/
-
Password Reuse in Disguise: An Often-Missed Risky Workaround
When security teams discuss credential-related risk, the focus typically falls on threats such as phishing, malware, or ransomware. These attack methods continue to evolve and rightly command attention. However, one of the most persistent and underestimated risks to organizational security remains far more ordinary.Near-identical password reuse continues to slip past security controls, often First seen…
-
AHA Releases New Guides to Strengthen Hospital Emergency and Cyber Preparedness
Healthcare organizations in the United States face threats, ranging from public health emergencies to cyberattacks. To support hospitals and health systems in enhancing their preparedness and resilience, the American Hospital Association (AHA) has released two comprehensive resources for cyber preparedness in healthcare. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/cyber-preparedness-in-healthcare/