Tag: threat
-
New backdoor ‘SesameOp’ abuses OpenAI Assistants API for stealthy C2 operations
Lessons for defenders and platform providers: Microsoft clarified that OpenAI’s platform itself wasn’t breached or exploited; rather, its legitimate API functions were misused as a relay channel, highlighting a growing risk as generative AI becomes part of enterprise and development workflows. Attackers can now co-opt public AI endpoints to mask malicious intent, making detection significantly…
-
New backdoor ‘SesameOp’ abuses OpenAI Assistants API for stealthy C2 operations
Lessons for defenders and platform providers: Microsoft clarified that OpenAI’s platform itself wasn’t breached or exploited; rather, its legitimate API functions were misused as a relay channel, highlighting a growing risk as generative AI becomes part of enterprise and development workflows. Attackers can now co-opt public AI endpoints to mask malicious intent, making detection significantly…
-
Ransomware Defense Using the Wazuh Open Source Platform
Tags: access, attack, computer, cyberattack, data, defense, infrastructure, malicious, malware, open-source, ransom, ransomware, software, threatRansomware is malicious software designed to block access to a computer system or encrypt data until a ransom is paid. This cyberattack is one of the most prevalent and damaging threats in the digital landscape, affecting individuals, businesses, and critical infrastructure worldwide.A ransomware attack typically begins when the malware infiltrates a system through various vectors…
-
Operation SkyCloak Deploys Tor-Enabled OpenSSH Backdoor Targeting Defense Sectors
Threat actors are leveraging weaponized attachments distributed via phishing emails to deliver malware likely targeting the defense sector in Russia and Belarus.According to multiple reports from Cyble and Seqrite Labs, the campaign is designed to deploy a persistent backdoor on compromised hosts that uses OpenSSH in conjunction with a customized Tor hidden service that employs…
-
Operation SkyCloak Deploys Tor-Enabled OpenSSH Backdoor Targeting Defense Sectors
Threat actors are leveraging weaponized attachments distributed via phishing emails to deliver malware likely targeting the defense sector in Russia and Belarus.According to multiple reports from Cyble and Seqrite Labs, the campaign is designed to deploy a persistent backdoor on compromised hosts that uses OpenSSH in conjunction with a customized Tor hidden service that employs…
-
Anatomy of Tycoon 2FA Phishing: Tactics Targeting M365 and Gmail
The Tycoon 2FA phishing kit represents one of the most sophisticated threats targeting enterprise environments today. This Phishing-as-a-Service (PhaaS) platform, which emerged in August 2023, has become a formidable adversary against organizational security, employing advanced evasion techniques and adversary-in-the-middle (AiTM) strategies to bypass multi-factor authentication protections. According to the Any.run malware trends tracker, Tycoon 2FA…
-
RondoDox Botnet Swells Its Arsenal, 650% Jump in Enterprise-Focused Exploits
The cybersecurity threat landscape shifted dramatically on October 30, 2025, when security researchers monitoring honeypot infrastructure detected a significantly evolved variant of the RondoDox botnet. The updated malware now features 75 distinct exploitation vectors, a fundamental expansion that transforms the threat from a primarily IoT-focused botnet into a multifaceted enterprise threat capable of targeting everything…
-
RondoDox Botnet Swells Its Arsenal, 650% Jump in Enterprise-Focused Exploits
The cybersecurity threat landscape shifted dramatically on October 30, 2025, when security researchers monitoring honeypot infrastructure detected a significantly evolved variant of the RondoDox botnet. The updated malware now features 75 distinct exploitation vectors, a fundamental expansion that transforms the threat from a primarily IoT-focused botnet into a multifaceted enterprise threat capable of targeting everything…
-
Hackers exploit critical auth bypass flaw in JobMonster WordPress theme
Threat actors are targeting a critical vulnerability in the JobMonster WordPress theme that allows hijacking of administrator accounts under certain conditions. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-exploit-critical-auth-bypass-flaw-in-jobmonster-wordpress-theme/
-
Hackers exploit critical auth bypass flaw in JobMonster WordPress theme
Threat actors are targeting a critical vulnerability in the JobMonster WordPress theme that allows hijacking of administrator accounts under certain conditions. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-exploit-critical-auth-bypass-flaw-in-jobmonster-wordpress-theme/
-
SesameOp: Using the OpenAI Assistants API for Covert C2 Communication
Microsoft’s Detection and Response Team has exposed a sophisticated backdoor malware that exploits the OpenAI Assistants API as an unconventional command-and-control communication channel. Named SesameOp, this threat demonstrates how adversaries are rapidly adapting to leverage legitimate cloud services for malicious purposes, making detection significantly more challenging for security teams. The discovery highlights the evolving tactics…
-
Microsoft Detects “SesameOp” Backdoor Using OpenAI’s API as a Stealth Command Channel
Microsoft has disclosed details of a novel backdoor dubbed SesameOp that uses OpenAI Assistants Application Programming Interface (API) for command-and-control (C2) communications.”Instead of relying on more traditional methods, the threat actor behind this backdoor abuses OpenAI as a C2 channel as a way to stealthily communicate and orchestrate malicious activities within the compromised First seen…
-
Fewer data breaches in Australia, but human error now a bigger threat
Privacy commissioner warns that the human factor is a growing threat as notifications caused by staff mistakes rose significantly even as total breaches declined 10% from a record high First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366633983/Fewer-data-breaches-in-Australia-but-human-error-now-a-bigger-threat
-
Cybercriminals Exploit RMM Tools to Target Trucking Firms and Hijack Freight
Cybercriminals are orchestrating sophisticated attacks against trucking and freight companies in elaborate schemes designed to steal cargo shipments worth millions. These threat actors are exploiting the digital transformation of the logistics industry, compromising transportation companies to fraudulently bid on legitimate cargo loads before stealing and reselling the goods. At the center of these operations is…
-
Cybercriminals Exploit RMM Tools to Target Trucking Firms and Hijack Freight
Cybercriminals are orchestrating sophisticated attacks against trucking and freight companies in elaborate schemes designed to steal cargo shipments worth millions. These threat actors are exploiting the digital transformation of the logistics industry, compromising transportation companies to fraudulently bid on legitimate cargo loads before stealing and reselling the goods. At the center of these operations is…
-
Scaling Your Security with NHIs: Key Insights
How Are Non-Human Identities Redefining Cybersecurity? Where cyber threats continue to evolve and multiply, how can organizations effectively safeguard their digital assets? The answer lies in the emerging focus on Non-Human Identities (NHIs). These machine identities are becoming crucial for scaling security solutions, ensuring seamless protection across various industries such as financial services, healthcare, and……
-
NDSS 2025 VulShield: Protecting Vulnerable Code Before Deploying Patches
Tags: attack, conference, data-breach, exploit, linux, network, software, threat, update, vulnerabilitySESSION Session 1D: System-Level Security Authors, Creators & Presenters: Yuan Li (Zhongguancun Laboratory & Tsinghua University), Chao Zhang (Tsinghua University & JCSS & Zhongguancun Laboratory), Jinhao Zhu (UC Berkeley), Penghui Li (Zhongguancun Laboratory), Chenyang Li (Peking University), Songtao Yang (Zhongguancun Laboratory), Wende Tan (Tsinghua University) PAPER VulShield: Protecting Vulnerable Code Before Deploying Patches Despite the…
-
Hackers Weaponize Remote Tools to Hijack Cargo Freight
Researchers uncovered a new threat campaign in which attackers use RMM tools to steal physical cargo out of the supply chain. First seen on darkreading.com Jump to article: www.darkreading.com/identity-access-management-security/hackers-weaponize-remote-tools-hijack-cargo-freight
-
Nation-State, Cyber and Hacktivist Threats Pummel Europe
Identity and Cloud Stacks Targeted as Adversaries Seek New Ways In, Experts Warn. Cyberattacks targeting European organizations continue to shape and be shaped by geopolitical events, whether they involve nation-state hackers, financially motivated cybercriminals or opportunistic hacktivists, says a new report from cybersecurity firm CrowdStrike. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/nation-state-cyber-hacktivist-threats-pummel-europe-a-29914
-
How Ransomware Attacks Leverage Cyber Insurance Policies
Ransomware attacks continue to evolve into sophisticated strategic and psychological operations. Threat actors are always seeking ways to maximize their illicit gains, and they’ve now discovered a powerful piece to leverage: a company’s cyber insurance policy. When attackers gain access to cyber policy details, they come to a ransomware negotiation already holding some of their..…
-
How Ransomware Attacks Leverage Cyber Insurance Policies
Ransomware attacks continue to evolve into sophisticated strategic and psychological operations. Threat actors are always seeking ways to maximize their illicit gains, and they’ve now discovered a powerful piece to leverage: a company’s cyber insurance policy. When attackers gain access to cyber policy details, they come to a ransomware negotiation already holding some of their..…
-
Zscaler adds more AI to its offerings with Splx acquisition
The Splx deal follows Zscaler’s recent acquisition of Red Canary, an AI-driven threat management company. First seen on cyberscoop.com Jump to article: cyberscoop.com/zscaler-splx-acquistion/
-
Zscaler adds more AI to its offerings with Splx acquisition
The Splx deal follows Zscaler’s recent acquisition of Red Canary, an AI-driven threat management company. First seen on cyberscoop.com Jump to article: cyberscoop.com/zscaler-splx-acquistion/
-
Security leaders say AI can help with governance, threat detection, SOC automation
Executives and technical leaders differ on AI priorities, according to a report from Amazon. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/amazon-ai-security-cloud-migration-report/804502/
-
Europe second only to North America for cyber attacks
Europe faces rising cyber threats from criminals and nation-states, according to CrowdStrike. Ransomware attacks now take just 24 hours, with 22% of global victims being European First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366634112/CrowdStrike-Europe-second-only-to-North-America-for-cyber-attacks