Tag: threat
-
Medusa Ransomware Actors Exploit Critical Fortra GoAnywhere Flaw
Researchers say exploitation of CVE-2025-10035 requires a private key, and it’s unclear how Storm-1175 threat actors pulled this off. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/medusa-ransomware-exploit-fortra-goanywhere-flaw
-
Alert over Medusa ransomware attacks targeting Fortra MFT
Microsoft warns it is seeing potential mass exploitation of a Fortra GoAnywhere vulnerability by a threat actor linked to the Medusa ransomware-as-a-service operation. First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366632336/Alert-over-Medusa-ransomware-attacks-targeting-Fortra-MFT
-
Top 10 Best Cyber Threat Intelligence Companies in 2025
In 2025, cyber threat intelligence companies are more crucial than ever as organizations face increasingly sophisticated attacks from advanced persistent threats, ransomware gangs, and state-sponsored actors. Choosing the best CTI (Cyber Threat Intelligence) provider can mean the difference between preventing an attack and suffering costly breaches. This article explores the Top 10 Best Cyber Threat…
-
Russia blocks mobile internet for foreign SIM cards, citing drone threats
The new rule imposes a mandatory 24-hour mobile internet blackout for anyone entering Russia with a foreign SIM card. First seen on therecord.media Jump to article: therecord.media/russia-blocks-mobile-internet-foreign-sim-cards
-
Redefining Security Validation with AI-Powered Breach and Attack Simulation
Security teams are drowning in threat intel, but AI is changing that. AI-powered Breach and Attack Simulation turns new threats into real, testable scenarios in minutes, delivering proof that your defenses work, not just assumptions. Join the BAS Summit 2025 to see how AI redefines security validation. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/redefining-security-validation-with-ai-powered-breach-and-attack-simulation/
-
Russia blocks mobile internet for foreign SIM cards, citing drone threats
The new rule imposes a mandatory 24-hour mobile internet blackout for anyone entering Russia with a foreign SIM card. First seen on therecord.media Jump to article: therecord.media/russia-blocks-mobile-internet-foreign-sim-cards
-
Don’t Let Your Cloud Security Catch a Bad Case of Permission Creep
Tags: access, attack, breach, cloud, compliance, control, data, exploit, governance, iam, identity, international, Internet, kubernetes, least-privilege, mfa, risk, service, software, technology, threat, tool, vulnerabilityCloud security teams are often blind to one of the biggest threats to cloud environments: a web of over-privileged identities that create pathways for attackers. Learn how to regain control of your cloud identities by automating the enforcement of least privilege across your environment. Key takeaways The gradual accumulation of excessive and unused cloud permissions,…
-
Don’t Let Your Cloud Security Catch a Bad Case of Permission Creep
Tags: access, attack, breach, cloud, compliance, control, data, exploit, governance, iam, identity, international, Internet, kubernetes, least-privilege, mfa, risk, service, software, technology, threat, tool, vulnerabilityCloud security teams are often blind to one of the biggest threats to cloud environments: a web of over-privileged identities that create pathways for attackers. Learn how to regain control of your cloud identities by automating the enforcement of least privilege across your environment. Key takeaways The gradual accumulation of excessive and unused cloud permissions,…
-
Google DeepMind launches an AI agent to fix code vulnerabilities automatically
Reactive and proactive security: The tool takes both reactive and proactive approaches to code security, Google DeepMind said. Reactively, it instantly patches new vulnerabilities. Proactively, it rewrites and secures existing code to eliminate entire classes of vulnerabilities.In one proactive example, Google DeepMind deployed CodeMender to apply -fbounds-safety annotations to parts of libwebp, a widely used…
-
CISA Alerts on Oracle E-Business Suite 0-Day Actively Exploited for Ransomware Attacks
Tags: attack, business, cisa, cve, cyber, cybercrime, cybersecurity, exploit, infrastructure, oracle, ransomware, threat, vulnerability, zero-dayThe Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent alert regarding a critical zero-day vulnerability in Oracle E-Business Suite that cybercriminals are actively exploiting to deploy ransomware attacks against organizations worldwide. The vulnerability, tracked as CVE-2025-61882, poses an immediate threat to enterprises running Oracle’s widely-used business management software. Critical Vulnerability Enables Complete System…
-
Cavalry Werewolf APT Targets Russian Organizations Using FoalShell and Telegram C2
Cavalry Werewolf, a Russian-focused advanced persistent threat (APT) cluster, has intensified its offensive operations by experimenting with new malware variants and leveraging Telegram-based command-and-control (C2). Security teams must prioritize real-time visibility into the tools employed by this group to maintain effective detection and prevention measures. Without timely insights into FoalShell and StallionRAT, defenders risk falling…
-
CrowdStrike Alerts on Oracle E-Business Suite 0-Day Under Mass Exploitation
Tags: business, crowdstrike, cyber, data, exploit, group, intelligence, oracle, remote-code-execution, threat, vulnerability, zero-dayA novel zero-day vulnerability in Oracle E-Business Suite (CVE-2025-61882) is being actively exploited in a large-scale data exfiltration campaign, with CrowdStrike Intelligence attributing primary involvement to the GRACEFUL SPIDER threat group and warning that public proof-of-concept details will spur further attacks. On August 9, 2025, the first suspected exploitation of an unauthenticated remote code execution…
-
Hackers Exploit Legitimate Commands to Breach Databases
In recent years, adversaries have abandoned traditional malware in favor of “living-off-the-land” operations against cloud and SaaS environments. Rather than deploying custom ransomware binaries, many threat actors now exploit misconfigured database services”, leveraging only built-in commands to steal, destroy, or encrypt data. Victims often discover their data missing or inaccessible, replaced only by ransom notes…
-
Microsoft Links Storm-1175 to GoAnywhere Exploit Deploying Medusa Ransomware
Microsoft on Monday attributed a threat actor it tracks as Storm-1175 to the exploitation of a critical security flaw in Fortra GoAnywhere software to facilitate the deployment of Medusa ransomware.The vulnerability is CVE-2025-10035 (CVSS score: 10.0), a critical deserialization bug that could result in command injection without authentication. It was addressed in version 7.8.4, or…
-
Microsoft Links Storm-1175 to GoAnywhere Exploit Deploying Medusa Ransomware
Microsoft on Monday attributed a threat actor it tracks as Storm-1175 to the exploitation of a critical security flaw in Fortra GoAnywhere software to facilitate the deployment of Medusa ransomware.The vulnerability is CVE-2025-10035 (CVSS score: 10.0), a critical deserialization bug that could result in command injection without authentication. It was addressed in version 7.8.4, or…
-
Survey Sees AI Becoming Top Cybersecurity Investment Priority
AI tops cybersecurity investments for 2025 as organizations leverage threat detection, AI agents, and behavioral analysis to close skills gaps and boost defense. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/10/survey-sees-ai-becoming-top-cybersecurity-investment-priority/
-
Is the CISO chair becoming a revolving door?
Tags: ai, automation, breach, business, ciso, cloud, control, cybersecurity, framework, governance, jobs, risk, skills, threatIs the stress worth the sacrifice?: For others in the CISO role, including Fullpath CISO Shahar Geiger Maor, the issue is less about boredom and more about the constant strain. “At any time there may be a breach. You live under the assumption that something is going to go wrong, and it’s very stressful,” he…
-
Scattered Spider Moves from Data Leaks to Insider-Powered Access Markets Targeting Microsoft, Apple, and More
Scattered Spider has shifted its operational strategy, moving away from chaotic data leaks toward a more structured and professional model of cybercrime. Now functioning as a hybrid of Ransomware-as-a-Service (RaaS) and insider threat operations, the group is building a network of internal collaborators within some of the world’s largest tech and telecom companies, including Microsoft…
-
Survey Sees AI Becoming Top Cybersecurity Investment Priority
AI tops cybersecurity investments for 2025 as organizations leverage threat detection, AI agents, and behavioral analysis to close skills gaps and boost defense. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/10/survey-sees-ai-becoming-top-cybersecurity-investment-priority/
-
GoAnywhere 0-Day RCE Actively Exploited to Deliver Medusa Ransomware
Tags: advisory, cve, cvss, cyber, data-breach, exploit, flaw, ransomware, rce, remote-code-execution, threat, vulnerability, zero-dayA critical zero-day vulnerability in GoAnywhere MFT’s License Servlet is being actively exploited to deploy Medusa ransomware. On September 18, 2025, Fortra released an advisory disclosing CVE-2025-10035, a deserialization flaw with a perfect CVSS score of 10.0. Threat actors tracked as Storm-1175 have abused this issue to gain remote code execution (RCE) on exposed systems,…
-
Oracle EBS Under Fire as Cl0p Exploits CVE-2025-61882 in Real-World Attacks
CrowdStrike on Monday said it’s attributing the exploitation of a recently disclosed security flaw in Oracle E-Business Suite with moderate confidence to a threat actor it tracks as Graceful Spider (aka Cl0p), and that the first known exploitation occurred on August 9, 2025.The exploitation involves the exploitation of CVE-2025-61882 (CVSS score: 9.8), a critical vulnerability…
-
Oracle EBS Under Fire as Cl0p Exploits CVE-2025-61882 in Real-World Attacks
CrowdStrike on Monday said it’s attributing the exploitation of a recently disclosed security flaw in Oracle E-Business Suite with moderate confidence to a threat actor it tracks as Graceful Spider (aka Cl0p), and that the first known exploitation occurred on August 9, 2025.The exploitation involves the exploitation of CVE-2025-61882 (CVSS score: 9.8), a critical vulnerability…
-
Cl0p Ransomware Actively Exploiting Oracle E-Business Suite 0-Day
Tags: advisory, attack, business, cve, cyber, data-breach, email, exploit, extortion, group, oracle, ransomware, threat, vulnerability, zero-dayThe notorious Cl0p ransomware group has beenactively exploiting a critical zero-day vulnerabilityin Oracle’s E-Business Suite (EBS), targeting enterprise customers through CVE-2025-61882. This sophisticated attack campaign has prompted Oracle to issue an emergency security advisory after reports surfaced that multiple organizations received extortion emails from the threat actors. Critical Zero-Day Vulnerability Exposed Oracle confirmed the exploitation…
-
Mustang Panda Adopts New DLL Side-Loading Method to Deploy Malware
The sophisticated China-linked threat actor Mustang Panda has refined its cyber espionage arsenal with an advanced DLL side-loading technique specifically targeting the Tibetan community, according to recent analysis of a campaign first identified by IBM’s X-Force in June 2025. This politically motivated operation demonstrates how threat actors continuously evolve their obfuscation methods to bypass security controls and…
-
Cl0p Ransomware Actively Exploiting Oracle E-Business Suite 0-Day
Tags: advisory, attack, business, cve, cyber, data-breach, email, exploit, extortion, group, oracle, ransomware, threat, vulnerability, zero-dayThe notorious Cl0p ransomware group has beenactively exploiting a critical zero-day vulnerabilityin Oracle’s E-Business Suite (EBS), targeting enterprise customers through CVE-2025-61882. This sophisticated attack campaign has prompted Oracle to issue an emergency security advisory after reports surfaced that multiple organizations received extortion emails from the threat actors. Critical Zero-Day Vulnerability Exposed Oracle confirmed the exploitation…
-
Mustang Panda Adopts New DLL Side-Loading Method to Deploy Malware
The sophisticated China-linked threat actor Mustang Panda has refined its cyber espionage arsenal with an advanced DLL side-loading technique specifically targeting the Tibetan community, according to recent analysis of a campaign first identified by IBM’s X-Force in June 2025. This politically motivated operation demonstrates how threat actors continuously evolve their obfuscation methods to bypass security controls and…
-
Creating Adaptable NHIs for Dynamic Markets
How Secure Are Your Machine Identities? Where cyber threats continue to increase in sophistication and frequency, how effectively are organizations managing their machine identities? The concept of Non-Human Identities (NHIs) is fast becoming a cornerstone, particularly for businesses that rely heavily on clouds. These NHIs, essentially machine identities, encompass both the encrypted secrets”, such as…
-
Are Your NHIs Capable Enough for New Threats?
Are Your Cybersecurity Measures Equipped to Handle the Unique Challenges of Non-Human Identities? Where cybersecurity threats evolve by the minute, are your cybersecurity measures truly robust enough to handle the increasing complexity of Non-Human Identities (NHIs)? The advent of cloud environments has redefined how organizations across financial services, healthcare, DevOps, and other industries manage their……