Tag: threat
-
Threat Actors Update Android Droppers to Remain Effective with Even Simple Malware
Threat actors are increasingly refining Android droppers to circumvent enhanced security measures, extending their utility beyond sophisticated banking trojans to simpler malware variants like SMS stealers and basic spyware. Historically, droppers served as innocuous entry points for payloads requiring elevated permissions, such as Accessibility Services, particularly after Android 13’s API restrictions limited direct installations. These…
-
Chinese UNC6384 Hackers Use Valid Code-Signing Certificates to Evade Detection
Google Threat Intelligence Group (GTIG) has uncovered a multifaceted cyber espionage operation attributed to the PRC-nexus threat actor UNC6384, believed to be associated with TEMP.Hex (also known as Mustang Panda). This campaign, aligned with China’s strategic interests, primarily targeted diplomats in Southeast Asia alongside global entities, employing advanced tactics such as adversary-in-the-middle (AitM) attacks, captive…
-
Behind the Coinbase breach: Bribery emerges as enterprise threat
Coinbase’s widely praised incident response: Coinbase’s transparency, firm stance against the ransom, quick remediation, and willingness to compensate its customers earned wide praise from cybersecurity professionals.According to Coinbase’s Martin, the hackers resorted to paying help desk workers in India precisely because the company had built such a robust security program. Bribery, according to Martin, was…
-
Das kostet ein Data Breach 2025
Tags: ai, api, breach, ciso, cyberattack, cyersecurity, data, data-breach, germany, ibm, infrastructure, intelligence, ransomware, risk, security-incident, siem, supply-chain, threat, usa, vulnerabilityLaut einer aktuellen Studie liegen die durchschnittlichen Kosten einer Datenpanne in Deutschland bei 3,87 Millionen Euro.Laut dem aktuellen ‘Cost of a Data Breach”- Report von IBM sind die Kosten einer Datenpanne in Deutschland auf 3,87 Millionen Euro (ca. 4,03 Millionen Dollar) pro Vorfall gesunken im Vorjahr lagen sie noch bei 4,9 Millionen Euro (ca. 5,31…
-
Hackers Scan Over 1,000 IPs to Target Microsoft Remote Desktop Web Access
A sophisticated scanning campaign has escalated dramatically, with threat intelligence firm GreyNoise detecting over30,000 unique IP addressessimultaneously probing Microsoft Remote Desktop Protocol (RDP) services on August 24, 2024. This represents a significant expansion from an initial wave of nearly 2,000 IPs observed just three days earlier, marking one of the largest coordinated RDP reconnaissance operations…
-
Workday Breach Breakdown: A Growing Trend of Breaches – Grip
The Workday breach highlights a rising wave of SaaS attacks. Learn why cyber threats spike in the second half of 2025 and how to stay ahead of the breach curve. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/08/workday-breach-breakdown-a-growing-trend-of-breaches-grip/
-
Ontic Secures $230M to Scale Connected Security Platform
Physical Security Firm Eyes Insider Risk, Federal Growth and AI-Powered Automation. Ontic has raised $230 million in Series C funding to expand its connected intelligence platform and pursue new federal and international markets. The Austin, Texas-based company will invest in AI, integrations and data to strengthen cyber-physical threat detection and automation. First seen on govinfosecurity.com…
-
5 Cloud Security Providers You Might Be Overlooking
Compare top cloud security companies offering tools to protect data, manage access, reduce threats, and ensure compliance First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/products/cloud-security-companies/
-
ThreatActors Leverage Google Classroom to Target 13,500 Organizations
Google Classroom, a popular educational platform, has been exploited by threat actors to launch a major phishing campaign in a complex operation discovered by Check Point researchers. Over a single week from August 6 to August 12, 2025, attackers disseminated more than 115,000 malicious emails across five coordinated waves, targeting approximately 13,500 organizations globally. These…
-
News alert: Attaxion launches agentless traffic monitoring to flag threats and prioritize risk
Dover, Del., Aug. 25, 2025, CyberNewswire”, Attaxion announces the addition of the Agentless Traffic Monitoring capability to its exposure management platform. Agentless Traffic Monitoring is a new capability designed to give cybersecurity teams actionable visibility into network traffic flowing to… (more”¦) First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/08/news-alert-attaxion-launches-agentless-traffic-monitoring-to-flag-threats-and-prioritize-risk/
-
NSFOCUS Monthly APT Insights July 2025
Regional APT Threat Situation In July 2025, the global threat hunting system of Fuying Lab detected a total of 33 APT attack activities. These activities were primarily concentrated in regions including South Asia, East Asia, Southeast Asia, Eastern Europe, and West Asia, as shown in the following figure. Regarding the activity levels of different organizations,…The…
-
How Exposure Management Has Helped Tenable Reduce Risk and Align with the Business
Each Monday, the Tenable Exposure Management Academy provides the practical, real-world guidance you need to shift from vulnerability management to exposure management. In the second of a two-part blog series, Tenable CSO Robert Huber shares how exposure management has helped him reduce risk and better align with the business. You can read the entire Exposure…
-
Fake Google Play Store Websites Deliver Potent RAT to Steal Sensitive Data
Cybersecurity researchers have uncovered a persistent campaign deploying the AndroidOS SpyNote malware, a sophisticated Remote Access Trojan (RAT) designed for surveillance, data exfiltration, and remote device control. This operation mimics legitimate Google Play Store pages for popular Android apps, tricking users into downloading malicious APK files. The campaign, linked to the same threat actor previously…
-
How Exposure Management Has Helped Tenable Reduce Risk and Align with the Business
Each Monday, the Tenable Exposure Management Academy provides the practical, real-world guidance you need to shift from vulnerability management to exposure management. In the second of a two-part blog series, Tenable CSO Robert Huber shares how exposure management has helped him reduce risk and better align with the business. You can read the entire Exposure…
-
Munich Reinsurance unites global security teams to boost resilience, cut costs
Tags: access, best-practice, business, cloud, conference, cyber, cybersecurity, defense, detection, edr, group, incident response, intelligence, jobs, lessons-learned, metric, network, resilience, risk, siem, skills, soc, strategy, tactics, threat, toolConsolidate functions into one incident response team, one threat intelligence team, and one threat-hunting team serving all Munich brands around the clock.Improve team capabilities by blending the strongest skills of each team into more mature, well-rounded functions.Reduce redundancies in responsibilities, tools, and processes to cut costs.To reach these goals, Munich deployed various tactics, including:Combining best…
-
2025 CSO Hall of Fame: Meg Anderson on AI, strategic security investments, and life after InfoSec
Tags: ai, automation, business, ciso, conference, cyber, cybersecurity, finance, infosec, jobs, metric, phishing, programming, risk, risk-management, software, strategy, technology, threat, toolWhich technologies are you most cautious about from a CISO’s point of view, and why?: Meg Anderson: I’m cautious of “solutions” that don’t solve a strategic problem. CISOs only have so much budget and mindshare. You need to understand where a tool fits in your investment and strategic roadmap. There were times when my team…
-
Chinese APT Leverages Proxy and VPN Services to Obfuscate Infrastructure
Tags: apt, china, cyber, cybersecurity, data, group, infrastructure, korea, leak, north-korea, service, threat, vpnA significant data dump surfaced on DDoSecrets.com, purportedly extracted from a workstation belonging to a threat actor targeting organizations in South Korea and Taiwan. The leak, detailed in an accompanying article, attributes the activity to the North Korean advanced persistent threat (APT) group known as Kimsuky, a sophisticated actor previously highlighted in cybersecurity advisories for…
-
Report Surfaces Increased Number of API Security Issues Involving AI
A report published today by Wallarm finds that of the 639 Common Vulnerabilities and Exposures (CVEs) pertaining to application programming interfaces (APIs) reported in Q2 2025, 34 involved issues relating to some type of use case tied to artificial intelligence (AI). Overall, two-thirds of the API CVEs represent either critical or high severity threats, according..…
-
Securing the Cloud in an Age of Escalating Cyber Threats
As threats intensify and cloud adoption expands, organizations must leave outdated security models behind. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/securing-cloud-age-escalating-cyber-threats
-
How Architectural Controls Can Help Fill the AI Security Gap
NCC Group’s David Brauchler III shares how foundational controls and threat modeling strategies can help secure agentic AI tools in ways traditional guardrails can’t. First seen on darkreading.com Jump to article: www.darkreading.com/cybersecurity-operations/architectural-controls-ai-security-gap
-
Threat Actors Exploit Windows Scheduled Tasks for Stealthy Persistence Without Additional Tools
Threat actors continue to use Scheduled Tasks and other built-in Windows features to create persistence in the ever-changing world of cybersecurity threats, frequently avoiding the need of external tools or complex zero-day exploits. As of 2025, despite advancements in attack techniques such as rootkits and dead-drop command-and-control (C2) mechanisms, traditional methods remain prevalent due to…
-
Hackers Abuse Python eval/exec Calls to Run Malicious Code
Threat actors are increasingly abusing native evaluation and execution functions to conceal and execute malicious payloads within innocent-looking packages on PyPI. Security researchers warn that while static analysis libraries such as hexora can detect many obfuscation techniques, attackers continue innovating ways to slip harmful code past simple scanners. Supply chain attacks targeting Python packages have surged, with…
-
New macOS Installer Boasts Lightning-Fast Data Theft, Marketed on Dark Web
A novel macOS infostealer malware, designated as Mac.c, has emerged as a formidable contender in the underground malware-as-a-service (MaaS) ecosystem. Developed openly by a threat actor operating under the pseudonym >>mentalpositive,
-
Transparent Tribe Targets Indian Govt With Weaponized Desktop Shortcuts via Phishing
The advanced persistent threat (APT) actor known as Transparent Tribe has been observed targeting both Windows and BOSS (Bharat Operating System Solutions) Linux systems with malicious Desktop shortcut files in attacks targeting Indian Government entities.”Initial access is achieved through spear-phishing emails,” CYFIRMA said. “Linux BOSS environments are targeted via weaponized .desktop First seen on thehackernews.com…
-
Pakistan-linked APT36 abuses Linux .desktop files to drop custom malware in new campaign
APT36 uses Linux .desktop files in new attacks on Indian gov & defense, aiming for data theft and persistent espionage access. Transparent Tribe (aka APT36, Operation C-Major, and Mythic Leopard), a Pakistan-linked threat actor, is using Linux .desktop files to load malware in new attacks against government and defense entities in India. The APT group…
-
How AI is reshaping cybersecurity operations
Tags: access, ai, attack, business, ciso, cloud, control, cyber, cybersecurity, data, defense, detection, encryption, finance, gartner, governance, guide, hacker, infrastructure, intelligence, jobs, malware, microsoft, monitoring, phishing, regulation, resilience, risk, sans, service, skills, soc, strategy, supply-chain, technology, threat, tool, training, updateBecause AI can perform tasks at speeds that supersede human capacity, it exponentially scales the amount of work that a cybersecurity function can do, says Rob T. Lee, chief of research for AI and emerging threats and head of faculty at SANS Institute.Moreover, AI excels at doing repetitive tasks near perfectly every time, so it…
-
Why a new AI tool could change how we test insider threat defenses
Insider threats are among the hardest attacks to detect because they come from people who already have legitimate access. Security teams know the risk well, but they often … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/08/25/ai-insider-threat-simulation/
-
Why satellite cybersecurity threats matter to everyone
Satellites play a huge role in our daily lives, supporting everything from global communications to navigation, business, and national security. As space becomes more crowded … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/08/25/brett-loubert-deloitte-satellite-cybersecurity-threats/