Collecting Cyber-News from over 60 sources

Tag: threat

Iran-Linked SpearSpecter Campaign Leveraging Personalized Social Engineering Against High-Value Officials

Nov 17, 2025 2:49 PM

Tags: cyber, defense, espionage, government, group, intelligence, iran, social-engineering, threat

Iranian threat actors aligned with the Islamic Revolutionary Guard Corps Intelligence Organization (IRGC-IO) are conducting a sophisticated espionage campaign tracked as SpearSpecter, systematically targeting high-value senior defense and government officials through personalized social engineering tactics. The threat group, operating under multiple aliases including APT42, Mint Sandstorm, Educated Manticore, and CharmingCypress, has demonstrated remarkable patience and…
New Detection Methods Uncovered for Outlook NotDoor Backdoor Malware

Nov 17, 2025 2:49 PM

Tags: backdoor, control, cyber, cybersecurity, detection, email, group, malware, microsoft, russia, threat

Cybersecurity researchers have unveiled comprehensive detection methodologies for NotDoor, a sophisticated backdoor malware that leverages Microsoft Outlook macros for covert command and control operations. The malware, attributed to the Russian state-sponsored threat group APT28 (Fancy Bear), represents an evolution in email-based persistence techniques that can evade traditional security controls. NotDoor was first identified by Lab52,…
Iran-Linked SpearSpecter Campaign Leveraging Personalized Social Engineering Against High-Value Officials

Nov 17, 2025 2:49 PM

Tags: cyber, defense, espionage, government, group, intelligence, iran, social-engineering, threat

Iranian threat actors aligned with the Islamic Revolutionary Guard Corps Intelligence Organization (IRGC-IO) are conducting a sophisticated espionage campaign tracked as SpearSpecter, systematically targeting high-value senior defense and government officials through personalized social engineering tactics. The threat group, operating under multiple aliases including APT42, Mint Sandstorm, Educated Manticore, and CharmingCypress, has demonstrated remarkable patience and…
Hackers Weaponize XWiki Flaw to Build and Rent Out Botnet Networks

Nov 17, 2025 2:49 PM

Tags: attack, botnet, crypto, cve, cyber, cybersecurity, exploit, flaw, hacker, intelligence, malware, network, threat, vulnerability

Cybersecurity researchers have observed a dramatic escalation in attacks exploiting a critical XWiki vulnerability, with multiple threat actors now leveraging CVE-2025-24893 to deploy botnets, cryptocurrency miners, and custom malware toolkits.”‹ The vulnerability, initially detected by VulnCheck’s Canary Intelligence system on October 28, 2025, has rapidly evolved from a single attacker’s exploit into a widespread multi-actor…
Akira ransomware expands to Nutanix AHV, raising stakes for enterprise security

Nov 17, 2025 1:49 PM

Tags: access, attack, backup, breach, business, cisco, data, detection, endpoint, exploit, firewall, infrastructure, leak, mfa, monitoring, network, ransomware, resilience, strategy, threat, update, veeam, vpn, vulnerability, windows

Threat that thrives in enterprise blind spots: Experts indicate that Akira leverages the blind spots that enterprises acknowledge but rarely fix. Of the blind spots, remote access tops the list, followed by patching.”Akira wins not because it has reinvented ransomware, but because it has perfected the parts enterprises fail to take seriously. It exploits the…
Akira ransomware expands to Nutanix AHV, raising stakes for enterprise security

Nov 17, 2025 1:49 PM

Tags: access, attack, backup, breach, business, cisco, data, detection, endpoint, exploit, firewall, infrastructure, leak, mfa, monitoring, network, ransomware, resilience, strategy, threat, update, veeam, vpn, vulnerability, windows

Threat that thrives in enterprise blind spots: Experts indicate that Akira leverages the blind spots that enterprises acknowledge but rarely fix. Of the blind spots, remote access tops the list, followed by patching.”Akira wins not because it has reinvented ransomware, but because it has perfected the parts enterprises fail to take seriously. It exploits the…
Dragon Breath Uses RONINGLOADER to Disable Security Tools and Deploy Gh0st RAT

Nov 17, 2025 1:49 PM

Tags: access, browser, china, chrome, google, microsoft, rat, threat, tool

The threat actor known as Dragon Breath has been observed making use of a multi-stage loader codenamed RONINGLOADER to deliver a modified variant of a remote access trojan called Gh0st RAT.The campaign, which is primarily aimed at Chinese-speaking users, employs trojanized NSIS installers masquerading as legitimate like Google Chrome and Microsoft Teams, according to Elastic…
North Korean threat actors use JSON sites to deliver malware via trojanized code

Nov 17, 2025 12:49 PM

Tags: korea, malware, north-korea, service, tactics, threat

North Korean Contagious Interview actors now host malware on JSON storage sites to deliver trojanized code projects, NVISO reports. North Korea-linked actors behind the Contagious Interview campaign have updated their tactics, using JSON storage services (e.g. JSON Keeper, JSONsilo, and npoint.io) to host and deliver malware through trojanized code projects, according to a new NVISO report. >>NVISO…
North Korean threat actors use JSON sites to deliver malware via trojanized code

Nov 17, 2025 12:49 PM

Tags: korea, malware, north-korea, service, tactics, threat

North Korean Contagious Interview actors now host malware on JSON storage sites to deliver trojanized code projects, NVISO reports. North Korea-linked actors behind the Contagious Interview campaign have updated their tactics, using JSON storage services (e.g. JSON Keeper, JSONsilo, and npoint.io) to host and deliver malware through trojanized code projects, according to a new NVISO report. >>NVISO…
Spam flooding npm registry with token stealers still isn’t under control

Nov 17, 2025 7:49 AM

Tags: access, antivirus, attack, authentication, blockchain, breach, control, credentials, crypto, detection, edr, exploit, finance, firewall, governance, identity, login, malicious, malware, mfa, monitoring, network, open-source, pypi, risk, software, spam, supply-chain, threat, tool, worm

CSO that number has now grown to 153,000.And while this payload merely steals tokens, other threat actors are paying attention, said Sonatype CTO Brian Fox.When Sonatype wrote about the campaign just over a year ago, it found a mere 15,000 packages that appeared to come from a single person.With the swollen numbers reported this week,…
Can NHIDR technologies fully protect my cloud data

Nov 17, 2025 6:49 AM

Tags: cloud, cybersecurity, data, identity, threat

How Secure Is Your Cloud Environment? Has your organization truly fortified its cloud environment against potential threats? Evolving cybersecurity continually presents new challenges, especially when it comes to protecting digital assets. Understanding Non-Human Identity and Secrets Security Management is crucial for reinforcing cloud data protection. Understanding Non-Human Identities and Their Importance Non-Human Identities (NHIs) are……
Anthropic: China-backed hackers launch first large-scale autonomous AI cyberattack

Nov 16, 2025 9:49 AM

Tags: ai, china, cyber, cyberattack, espionage, hacker, threat

China-linked actors used Anthropic’s AI to automate and run cyberattacks in a sophisticated 2025 espionage campaign using advanced agentic tools. China-linked threat actors used Anthropic’s AI to automate and execute cyberattacks in a highly sophisticated espionage campaign in September 2025. The cyber spies leveraged advanced “agentic” capabilities rather than using AI only for guidance. Attackers…
Decades-old ‘Finger’ protocol abused in ClickFix malware attacks

Nov 15, 2025 8:49 PM

Tags: attack, malware, threat, windows

The decades-old “finger” command is making a comeback,, with threat actors using the protocol to retrieve remote commands to execute on Windows devices. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/decades-old-finger-protocol-abused-in-clickfix-malware-attacks/
Worm flooding npm registry with token stealers still isn’t under control

Nov 15, 2025 5:49 AM

Tags: access, antivirus, attack, authentication, blockchain, breach, control, credentials, crypto, detection, edr, exploit, finance, firewall, governance, identity, login, malicious, malware, mfa, monitoring, network, open-source, pypi, risk, software, supply-chain, threat, tool, worm

CSO that number has now grown to 153,000.”It’s unfortunate that the worm isn’t under control yet,” said Sonatype CTO Brian Fox.And while this payload merely steals tokens, other threat actors are paying attention, he predicted.”I’m sure somebody out there in the world is looking at this massively replicating worm and wondering if they can ride…
Which technologies keep AI-driven security ahead of threats

Nov 15, 2025 12:49 AM

Tags: ai, cloud, intelligence, threat

How Can AI-Driven Security Stay Ahead of Emerging Threats? What are the processes that ensure AI-driven security solutions tackle evolving threats efficiently? Where organizations transition to cloud environments, understanding and managing Non-Human Identities (NHIs) becomes crucial. NHIs represent machine identities that are foundational for maintaining robust cloud security. Integrating artificial intelligence (AI) enhances the management……
Which technologies keep AI-driven security ahead of threats

Nov 15, 2025 12:49 AM

Tags: ai, cloud, intelligence, threat

How Can AI-Driven Security Stay Ahead of Emerging Threats? What are the processes that ensure AI-driven security solutions tackle evolving threats efficiently? Where organizations transition to cloud environments, understanding and managing Non-Human Identities (NHIs) becomes crucial. NHIs represent machine identities that are foundational for maintaining robust cloud security. Integrating artificial intelligence (AI) enhances the management……
From detection to response: Why confidence is the real game changer

Nov 15, 2025 12:49 AM

Tags: cyber, detection, network, threat, tool

Why network visibility is the flashlight: The ESG study makes this clear: Network visibility isn’t just another layer of detection. It’s the lens that turns noise into knowledge. Packets capture everything attackers do”, every beacon, every lateral move, every exfiltration attempt. That means analysts can quickly validate alerts, scope exposure, and move with precision when minutes matter.And contrary to the…
Why SOC efficiency is the most valuable currency in cybersecurity

Nov 15, 2025 12:49 AM

Tags: cyber, cybersecurity, detection, intelligence, network, soc, threat

Packets as a force multiplier: Think of packet visibility as a force multiplier. A junior analyst, armed with raw alerts, might take hours to piece together an investigation. But with packet-level context, knowing exactly what was communicated, when, and to where, that same analyst can validate and scope an incident in minutes. That’s not just…
Why network visibility is the thread that holds cybersecurity together

Nov 15, 2025 12:49 AM

Tags: attack, cyber, cybersecurity, data, detection, incident response, intelligence, network, threat, tool

The common ground: The network as source of truth: So where do organizations turn when environments get too complex and alerts feel untrustworthy? To the one thing every attack must cross: the network.Forty-one percent of security leaders say network detection and response tools are the best equipped to provide visibility across hybrid, multicloud environments. That’s because packets…
Why SOC efficiency is the most valuable currency in cybersecurity

Nov 15, 2025 12:49 AM

Tags: cyber, cybersecurity, detection, intelligence, network, soc, threat

Packets as a force multiplier: Think of packet visibility as a force multiplier. A junior analyst, armed with raw alerts, might take hours to piece together an investigation. But with packet-level context, knowing exactly what was communicated, when, and to where, that same analyst can validate and scope an incident in minutes. That’s not just…
Why network visibility is the thread that holds cybersecurity together

Nov 15, 2025 12:49 AM

Tags: attack, cyber, cybersecurity, data, detection, incident response, intelligence, network, threat, tool

The common ground: The network as source of truth: So where do organizations turn when environments get too complex and alerts feel untrustworthy? To the one thing every attack must cross: the network.Forty-one percent of security leaders say network detection and response tools are the best equipped to provide visibility across hybrid, multicloud environments. That’s because packets…
New Security Tools Target Growing macOS Threats

Nov 14, 2025 10:49 PM

Tags: apple, macOS, malware, threat, tool

A public dataset and platform-agnostic analysis tool aim to help organizations in the fight against Apple-targeted malware, which researchers say has lacked proper attention. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/new-security-tools-target-growing-macos-threats
ShinyHunters Compromises Legacy Cloud Storage System of Checkout.com

Nov 14, 2025 9:49 PM

Tags: cloud, cybersecurity, group, hacker, ransom, threat

Checkout.com said the notorious ShinyHunters threat group breached a badly decommissioned legacy cloud storage system last used by the company in 2020 and stole some merchant data. The hackers demanded a ransom, but the company instead will give the amount demanded to cybersecurity research groups. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/11/shinyhunters-breaches-legacy-cloud-storage-system-of-checkout-com/
The Trojan Prompt: How GenAI is Turning Staff into Unwitting Insider Threats

Nov 14, 2025 7:49 PM

Tags: ai, compliance, finance, threat

When a wooden horse was wheeled through the gates of Troy, it was welcomed as a gift but hid a dangerous threat. Today, organizations face the modern equivalent: the Trojan prompt. It might look like a harmless request: “summarize the attached financial report and point out any potential compliance issues.” Within seconds, a generative AI..…
TDL 009 – Inside DNS Threat Intelligence: Privacy, Security Innovation

Nov 14, 2025 7:49 PM

Tags: access, apple, attack, automation, backup, best-practice, business, ceo, cisco, ciso, cloud, computer, control, corporate, country, crime, cybersecurity, data, dns, encryption, finance, firewall, government, infrastructure, intelligence, Internet, jobs, law, linkedin, malicious, marketplace, middle-east, monitoring, msp, network, office, privacy, regulation, risk, service, software, strategy, threat, tool, windows, zero-trust

Summary Inside DNS Threat Intelligence: Privacy, Security & Innovation In this episode of the Defenders Log, host David Redekop speaks with Tim Adams, the founder of the protective DNS resolver Scout DNS. Tim shares his origin story, explaining how he transitioned from a wireless network integrator to building his own DNS solution. He saw a…
The Trojan Prompt: How GenAI is Turning Staff into Unwitting Insider Threats

Nov 14, 2025 7:49 PM

Tags: ai, compliance, finance, threat

When a wooden horse was wheeled through the gates of Troy, it was welcomed as a gift but hid a dangerous threat. Today, organizations face the modern equivalent: the Trojan prompt. It might look like a harmless request: “summarize the attached financial report and point out any potential compliance issues.” Within seconds, a generative AI..…
Anthropic claims of Claude AI-automated cyberattacks met with doubt

Nov 14, 2025 7:49 PM

Tags: ai, china, cyber, cyberattack, espionage, group, threat

Anthropic reports that a Chinese state-sponsored threat group, tracked as GTG-1002, carried out a cyber-espionage operation that was largely automated through the abuse of the company’s Claude Code AI model. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/anthropic-claims-of-claude-ai-automated-cyberattacks-met-with-doubt/
North Korean Hackers Turn JSON Services into Covert Malware Delivery Channels

Nov 14, 2025 7:49 PM

Tags: hacker, malicious, malware, north-korea, service, tactics, threat

The North Korean threat actors behind the Contagious Interview campaign have once again tweaked their tactics by using JSON storage services to stage malicious payloads.”The threat actors have recently resorted to utilizing JSON storage services like JSON Keeper, JSONsilo, and npoint.io to host and deliver malware from trojanized code projects, with the lure,” NVISO researchers…
Checkout.com snubs hackers after data breach, to donate ransom instead

Nov 14, 2025 5:49 PM

Tags: breach, cloud, data, data-breach, finance, group, hacker, ransom, technology, threat

UK financial technology company Checkout announced that the ShinyHunters threat group has breached one of its legacy cloud storage systems and is now extorting the company for a ransom. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/checkoutcom-snubs-shinyhunters-hackers-to-donate-ransom-instead/
The Best Platforms for Enterprise Cyber Risk Management

Nov 14, 2025 5:49 PM

Tags: ai, attack, business, cyber, risk, risk-management, supply-chain, threat