Tag: threat
-
China-Aligned FamousSparrow Deploys SparroWocky Backdoor Across Latin America
The China-aligned state-sponsored threat actor known as FamousSparrow has been observed deploying a previously unreported backdoor called SparroWocky in attacks targeting multiple countries in Latin America since at least August 2025.”SparroWocky is a modular, C++ backdoor,” ESET security researchers Alexandre Côté Cyr and Romain Dumont said in a technical report shared with The Hacker News…
-
FamousSparrow Deploys New SparroWocky Backdoor Against Latin American Governments
China-aligned advanced persistent threat group FamousSparrow has replaced its long-running SparrowDoor implant with a new modular C++ backdoor, SparroWocky, in a sustained cyberespionage campaign against government entities across Latin America. ESET says the malware has been active in the region since at least August 2025, following a sharp shift in the group’s victim targeting that…
-
APT36 Targets Indian Government and Defense Organizations With New Rust Malware Arsenal
Pakistan-nexus threat actor APT36 has launched a renewed espionage campaign targeting government and defense organizations in India and Afghanistan. Deploying a new Rust-based malware suite designed for covert command-and-control, data theft, and propagation into isolated networks. Tracked by Zscaler ThreatLabz as Operation RapidRust, the activity was observed in August 2026 and reflects a significant evolution…
-
NightEagle Hackers Abuse Microsoft Dev Tunnels and GhostContainer to Breach Russian Companies
The NightEagle advanced persistent threat group, tracked as APT-Q-95, has expanded its operations to target businesses in Russia, combining stolen VPN credentials, a stealthy Microsoft Exchange backdoor, and legitimate tunneling technologies to move through victim networks. Researchers from Kaspersky’s Global Emergency Response Team said the group has been active since at least 2023 and previously…
-
RatHat Abuses Android Wireless Debugging to Gain Shell Access and Steal Banking PINs
RatHat, a newly identified Android banking malware family that combines Accessibility abuse, local Android Debug Bridge (ADB) pairing, native shell-level components, and generative-AI-assisted interface automation. The operation appears linked to China-based threat actors and is primarily designed to steal banking credentials, payment PINs, one-time passwords, device-unlock secrets, and other high-value data from infected Android devices.…
-
NightEagle Hackers Target Russian Companies Using GhostContainer Backdoor
The NightEagle advanced persistent threat group, tracked as APT-Q-95, has expanded its operations to target businesses in Russia, combining stolen VPN credentials, a stealthy Microsoft Exchange backdoor, and legitimate tunneling technologies to move through victim networks. Researchers from Kaspersky’s Global Emergency Response Team said the group has been active since at least 2023 and previously…
-
The world must establish red lines for autonomous AI weapons
AI is transforming warfare and international conflict. Autonomous weapon systems pose a genuine threat to civilians. The war in Ukraine has become a proving ground for weapons … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/09/17/autonomous-ai-weapons-future/
-
Hugging Face Calls for Wider Access to AI Cyber Defenses
CEO Clem Delangue Urges Frontier Labs to Share Models, Compute and Threat Data. Organizations need more transparency and access to models and tools to fight against cyberattacks, according to Hugging Face CEO Clem Delangue, who said Wednesday that frontier should provide more compute and information. Hugging Face asked OpenAI for $100 million in compute. First…
-
Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH
IntroductionIn August 2026, Zscaler ThreatLabz observed new activity by the Pakistan-nexus threat actor APT36 in a campaign we’re tracking as Operation RapidRust. Since our last publication about the group’s activity in January 2026, APT36 has maintained a high operational tempo and updated… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/operation-rapidrust-apt36-deploys-rustyshade-rustymove-psnatch-and-bashnatch/
-
Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers
Enterprises in Russia have emerged as the target of three threat activity clusters tracked as NightEagle, Hacking Cat, and Toy Ghouls, according to multiple reports from Kaspersky.The cybersecurity vendor said it has identified attacks mounted by NightEagle (aka APT-Q-95), a threat actor known to be active since at least 2023, that involve new techniques for…
-
Revolut Data Leak May Trace Back to Compromised Italian Government Accounts
A suspected compromise of an Italian government PEC account may have allowed threat actors to impersonate law enforcement and obtain sensitive data from hundreds of Revolut customers. The Revolut data exposure may be part of a much broader cyber incident involving compromised Italian government infrastructure. Revolut has confirmed that its systems were not breached. Instead,…
-
EU chief wants joint response to cyberattacks, sabotage
Delivering her annual State of the Union address in Strasbourg, Ursula von der Leyen said threats were “mounting on our soil,” pointing to recent incidents in Denmark, Lithuania and Poland and an attempted drone attack in Leipzig. First seen on therecord.media Jump to article: therecord.media/eu-chief-wants-joint-response-to-cyberattacks
-
Wie Angreifer die Microsoft-365-Funktion ‘Direct Send” ausnutzen
KnowBe4 Threat Lab dokumentiert fast 30.000 gefälschte interne E-Mails in nur zwei Monaten, versendet über die eigene Infrastruktur der Opfer und ganz ohne Passwort oder gestohlene Zugangsdaten. E-Mails genießen im Arbeitsalltag einen Vertrauensvorschuss. Wenn eine Nachricht scheinbar aus der Personalabteilung, der Buchhaltung oder von der Geschäftsführung kommt, wird sie selten hinterfragt. Genau diesen Reflex machen…
-
Wie Angreifer die Microsoft-365-Funktion ‘Direct Send” ausnutzen
KnowBe4 Threat Lab dokumentiert fast 30.000 gefälschte interne E-Mails in nur zwei Monaten, versendet über die eigene Infrastruktur der Opfer und ganz ohne Passwort oder gestohlene Zugangsdaten. E-Mails genießen im Arbeitsalltag einen Vertrauensvorschuss. Wenn eine Nachricht scheinbar aus der Personalabteilung, der Buchhaltung oder von der Geschäftsführung kommt, wird sie selten hinterfragt. Genau diesen Reflex machen…
-
Wie Angreifer die Microsoft-365-Funktion ‘Direct Send” ausnutzen
KnowBe4 Threat Lab dokumentiert fast 30.000 gefälschte interne E-Mails in nur zwei Monaten, versendet über die eigene Infrastruktur der Opfer und ganz ohne Passwort oder gestohlene Zugangsdaten. E-Mails genießen im Arbeitsalltag einen Vertrauensvorschuss. Wenn eine Nachricht scheinbar aus der Personalabteilung, der Buchhaltung oder von der Geschäftsführung kommt, wird sie selten hinterfragt. Genau diesen Reflex machen…
-
Chinese-Speaking Hackers Use Noodle RAT Backdoor to Spy on Windows and Linux Systems
Chinese-speaking threat actors are continuing to rely on Noodle RAT, a cross-platform remote access trojan designed to maintain covert access to compromised Windows workstations and Linux servers. Also tracked as ANGRYREBEL and Nood RAT, the malware has been active since at least mid-2016 but was long mistaken for variants of Gh0st RAT, Rekoobe, and other…
-
N0va Phishkit Targets US and EU Businesses: A New Challenge for Identity Security
N0va is targeting organizations across North America and Europe with phishing campaigns that impersonate trusted services and abuse legitimate authentication flows. Successful attacks can give threat actors access to valid accounts without relying on obvious malware activity.From there, a single compromised identity can open the door to sensitive data, business systems, and additional cloud First…
-
Threat Intelligence Alone Won’t Close the Exploitation Gap
Tags: advisory, ai, breach, credentials, data-breach, exploit, intelligence, marketplace, threat, vulnerabilityA leaked credential shows up in a criminal marketplace, or a vulnerability gets a disclosure advisory, and either one can be weaponized against a real target before most security teams have triaged the alert. Attackers are combining that kind of intelligence with AI-assisted exploitation to accelerate the path from exposure to breach faster than most…
-
Major Cyber Vendors Turn to New UK Testing Program as MITRE Evaluations Face Changes
A group of cyber threat detection providers, including CrowdStrike, Palo Alto Networks and Sophos, have joined SE Labs’ PIVOT program First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/cyber-vendors-mitre-uk-testing/
-
Major Cyber Vendors Turn to New UK Testing Program as MITRE Evaluations Face Changes
A group of cyber threat detection providers, including CrowdStrike, Palo Alto Networks and Sophos, have joined SE Labs’ PIVOT program First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/cyber-vendors-mitre-uk-testing/
-
Advice for CIOs on AI’s ‘existential threat’
Statements by OpenAI chief Sam Altman, following an essay by Anthropic chief Dario Amodei, raise concerns over the safety of frontier models First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366650475/Advice-for-CIOs-on-AIs-existential-threat
-
Quorum Cyber Adds Autonomous SOC Through Ontinue Acquisition
Proposed Purchase Combines Agentic SOC Technology With Managed Security Expertise. Quorum Cyber’s planned acquisition of Swiss Microsoft Gold Partner Ontinue would combine Microsoft-focused managed security with agentic SOC technology designed to investigate threats at machine speed while giving customers control over when AI can act autonomously. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/quorum-cyber-adds-autonomous-soc-through-ontinue-acquisition-a-32826
-
Pakistan Finalizes 90-Day Cybersecurity Action Plan, Federal CERT to Lead Rollout
Pakistan’s federal government has completed work on a 90-day cybersecurity action plan designed to build a more coordinated national defense against digital threats, bringing together federal and provincial governments, regulators and operators of critical infrastructure under one framework. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/pakistan-cybersecurity-action-plan/
-
Pakistan Finalizes 90-Day Cybersecurity Action Plan, Federal CERT to Lead Rollout
Pakistan’s federal government has completed work on a 90-day cybersecurity action plan designed to build a more coordinated national defense against digital threats, bringing together federal and provincial governments, regulators and operators of critical infrastructure under one framework. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/pakistan-cybersecurity-action-plan/
-
Iranian hackers use CHOSEN BRICK data-stealing malware to spy on dissidents and journalists
Iranian state cyber actors are deploying malware called CHOSEN BRICK against individuals they see as a threat to the regime, reaching victims through social messaging apps and … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/09/16/iranian-hackers-chosen-brick-malware-dissidents-journalists/
-
China-Aligned Hackers Hide PeckBirdy Malware C2 Inside Casino and Adult Websites
China-aligned threat actors are concealing the PeckBirdy command-and-control framework inside low-quality Chinese-language casino and adult websites. Exploiting a vast and routinely ignored category of internet infrastructure to blend malware traffic into apparent gambling activity. The activity expands on earlier findings by Trend Micro, which identified PeckBirdy as a flexible JScript-based C2 framework used by China-aligned…
-
Major Cyber Threat Detection Vendors Shift from MITRE to UK Testing Program
A group of cyber threat detection providers, including CrowdStrike, Palo Alto Networks and Sophos, have joined SE Labs’ PIVOT program First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/cyber-vendors-mitre-uk-testing/
-
Attackers Exploit WooCommerce Wholesale Lead Capture Flaw to Plant PHP Web Shells
Threat actors are exploiting a critical security flaw in WooCommerce Wholesale Lead Capture, a premium WordPress plugin that has more than 6,000 active installs.”This vulnerability can be leveraged by unauthenticated attackers to upload arbitrary files, including PHP backdoors, and achieve remote code execution,” Wordfence said.The WordPress security company said it has blocked over First seen…
-
Luciferus Uncensored AI Service Lets Cybercriminals Generate RAT Malware
Cybercriminals are promoting a new “uncensored” artificial intelligence service called Luciferus that allegedly generates malicious code, including components for remote access trojans (RATs), without the safeguards typically found in mainstream AI platforms. Researchers from the Sophos Counter Threat Unit reported that they first noticed a user named “Optimus_Prime” advertising this subscription service on August 24.…
-
Cyber Op Targets South Korean Media & Automotive Sectors
A likely North Korean advanced persistent threat (APT) group used a previously undocumented Linux espionage toolkit to compromise load balancers, gain access to communications, and further exploit networks. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/cyber-south-korean-media-automotive