Tag: threat
-
Attackers Use Fake OAuth Apps with Tycoon Kit to Breach Microsoft 365 Accounts
Cybersecurity researchers have detailed a new cluster of activity where threat actors are impersonating enterprises with fake Microsoft OAuth applications to facilitate credential harvesting as part of account takeover attacks.”The fake Microsoft 365 applications impersonate various companies, including RingCentral, SharePoint, Adobe, and Docusign,” Proofpoint said in a Thursday report.The First seen on thehackernews.com Jump to…
-
Blizzard Group’s ApolloShadow Malware Installs Root Certificates to Trust Malicious Sites
Tags: blizzard, cyber, cyberespionage, data-breach, group, intelligence, Internet, malicious, malware, microsoft, russia, service, threatMicrosoft Threat Intelligence has exposed a sophisticated cyberespionage operation orchestrated by the Russian state-sponsored actor tracked as Secret Blizzard, which has been actively compromising foreign embassies in Moscow through an adversary-in-the-middle (AiTM) technique to deploy the custom ApolloShadow malware. This campaign, ongoing since at least 2024, leverages an AiTM position at the Internet Service Provider…
-
Threat Actors Impersonate Microsoft OAuth Apps to Steal Login Credentials
Tags: adobe, authentication, credentials, cyber, login, malicious, microsoft, phishing, theft, threatThreat actors are leveraging sophisticated phishing campaigns by creating fake Microsoft OAuth applications to impersonate legitimate enterprises, enabling credential theft while bypassing multifactor authentication (MFA). Proofpoint researchers have tracked this activity since early 2025, identifying over 50 impersonated applications, including those mimicking RingCentral, SharePoint, Adobe, and DocuSign. These malicious OAuth apps serve as initial lures,…
-
APT36 Hackers Target Indian Railways, Oil, and Government Systems Using Malicious PDF Files
Tags: cyber, government, group, hacker, india, infection, infrastructure, malicious, military, threatThe Pakistan-linked threat group APT36, also known as Transparent Tribe, has broadened its cyber operations beyond traditional military targets to encompass Indian railways, oil and gas infrastructure, and the Ministry of External Affairs. Security researchers have uncovered two sophisticated desktop-based infection chains leveraging .desktop files disguised as PDF documents, which execute malicious scripts to deploy…
-
Threat Actors Exploit Proofpoint and Intermedia Link Wrapping to Conceal Phishing Payloads
Cybercriminals are increasingly exploiting link wrapping features from vendors like Proofpoint and Intermedia to mask malicious payloads, leveraging the inherent trust users place in these security tools. Link wrapping, intended as a protective measure, reroutes URLs through vendor scanning services such as Proofpoint’s urldefense.proofpoint.com or Intermedia’s url.emailprotection.link to inspect and block threats at click time.…
-
Exciting Developments in NHIDR
Are You Prepared to Tackle the Evolving Landscape of Cybersecurity? Data breaches, security threats, and compliance issues these are common narratives. Amid the cacophony of these significant challenges, is your organization prepared to combat evolving cybersecurity? If your answer is shrouded in doubt, it’s time to look at a holistic approach to secrets and… First…
-
Storm-2603 Deploys DNS-Controlled Backdoor in Warlock and LockBit Ransomware Attacks
The threat actor linked to the exploitation of the recently disclosed security flaws in Microsoft SharePoint Server is using a bespoke command-and-control (C2) framework called AK47 C2 (also spelled ak47c2) in its operations.The framework includes at least two different types of clients, HTTP-based and Domain Name System (DNS)-based, which have been dubbed AK47HTTP and AK47DNS,…
-
Insider Threats: Rache ist nicht das einzige Motiv
Als sei es nicht Herausforderung genug, sich gegen Cyberangriffe jedweder Art zu verteidigen, müssen Unternehmen mittlerweile auch um Gefahren aus den eigenen Reihen fürchten. Immer häufiger hört man von ‘Insider Threats” und abtrünnigen Mitarbeitern, die sensible Firmeninformationen gegen Geld veräußern. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/insider-threats-rache-ist-nicht-das-einzige-motiv
-
Summer: Why cybersecurity must be strengthened as vacations abound
Tags: access, ai, attack, authentication, automation, awareness, backup, control, corporate, credentials, cybersecurity, data, detection, email, encryption, exploit, infrastructure, malicious, mfa, monitoring, network, office, password, resilience, risk, theft, threat, tool, training, update, usa, vpn, wifiGuillermo Fernandez, Sales Engineer for Southern Europe at WatchGuard Technologies. WatchGuard Technologies.Another important point is that, during the summer, attackers know that many IT and cybersecurity teams are operating with more limited resources or with staff on vacation. “They take advantage of this to launch phishing campaigns and other targeted attacks, aware that attention and vigilance often…
-
Cyberangriff auf eine öffentlich-rechtliche Rundfunkanstalt in Irland?
RTÉ assessing potential cyber threat First seen on rte.ie Jump to article: www.rte.ie/news/business/2025/0728/1525819-rte-cyber/
-
What attackers know about your company thanks to AI
In this Help Net Security video, Tom Cross, Head of Threat Research at GetReal Security, explores how generative AI is empowering threat actors. He breaks down three key … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/08/01/ai-powered-cyber-threats-video/
-
Hackers Abuse EDR Free Trials to Bypass Endpoint Protection
Cybersecurity researchers have uncovered a concerning new attack vector where threat actors are exploiting free trials of endpoint detection and response (EDR) software to disable existing security protections on targeted systems. This technique, dubbed >>BYOEDR
-
8 Best wordpress security plugins in 2025
Protect your site with the best WordPress Security plugin of 2025. Block threats, scan for malware, and secure logins with top-rated tools First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/07/8-best-wordpress-security-plugins-in-2025/
-
Over 17,000 SharePoint Servers Found Exposed Online, 840 Vulnerable to Active 0-Day Attacks
Tags: attack, china, cve, cyber, cybersecurity, data-breach, finance, government, healthcare, Internet, microsoft, threat, vulnerability, zero-dayA significant cybersecurity crisis has emerged with the discovery of over 17,000 Microsoft SharePoint servers exposed to internet-based attacks, including 840 systems vulnerable to a critical zero-day vulnerability that Chinese threat actors are actively exploiting. The vulnerability, designated CVE-2025-53770 and dubbed >>ToolShell
-
SentinelLabs uncovers China’s hidden cyber-espionage arsenal
CSOonline that the most important pieces of new information gleaned from the findings are that “China’s contracting ecosystem forces many companies and individuals to collaborate on intrusions. This means many China-based Advanced Persistent Threats (APTs) may actually contain many different companies with many different clients.”The nation’s diverse private sector offensive ecosystem, he said, “supports a…
-
Attackers wrap phishing links through URL scanning services to bypass detection
urldefense.proofpoint.com and url.emailprotection.link (Intermedia).”Link wrapping is designed by vendors like Proofpoint to protect users by routing all clicked URLs through a scanning service, allowing them to block known malicious destinations at the moment of click,” Cloudflare researchers wrote in their report on the attacks. “While this is effective against known threats, attacks can still succeed…
-
How to Run a Firewall Test: A Guide for Enterprises
Cyber threats evolve quickly, and firewalls are often the first line of defense. However, having one in place isn’t the same as having one that works the way you expect…. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/07/how-to-run-a-firewall-test-a-guide-for-enterprises/
-
Russia-linked APT Secret Blizzard targets foreign embassies in Moscow with ApolloShadow malware
Russia-linked Secret Blizzard targets foreign embassies in Moscow via ISP-level AitM attacks, deploying custom ApolloShadow malware. Microsoft researchers uncovered a cyberespionage campaign by the Russia-linked APT group Secret Blizzard (aka Turla, Snake, Uroburos, Waterbug, Venomous Bear and KRYPTON) targeting foreign embassies in Moscow. The threat actor uses an adversary-in-the-middle (AiTM) method at the ISP level to deploy custom malware called ApolloShadow. This…
-
Unit 42 Launches Attribution Framework to Classify Threat Actors by Behavior and Activity
Unit 42, the threat research division of Palo Alto Networks, has unveiled its Attribution Framework, designed to transform the traditionally subjective process of threat actor attribution into a structured, evidence-based science. Drawing on the foundational Diamond Model of Intrusion Analysis, this framework integrates the Admiralty System to assign reliability and credibility scores to evidentiary data,…
-
Threat Actors Use Malicious RMM Tools for Stealthy Initial Access to Organizations
A small increase in targeted cyberattacks that make use of Remote Monitoring and Management (RMM) capabilities that are embedded in PDF documents has been seen by WithSecure. These campaigns primarily focus on organizations in France and Luxembourg, employing socially engineered emails to deliver innocuous PDFs containing hyperlinks to legitimate RMM installers. This method effectively circumvents…
-
Anubis Ransomware Targets Android and Windows Users to Encrypt Files and Steal Credentials
Ransomware activity has skyrocketed in the ever-evolving cyber threat landscape, with Bitsight’s State of the Underground 2025 study indicating a 53% increase in ransomware group-operated leak sites and a roughly 25% increase in unique victims reported on leak sites throughout 2024. Amid this escalation, the Anubis ransomware variant has emerged as a formidable player, first…
-
3 Things CFOs Need to Know About Mitigating Threats
To reposition cybersecurity as a strategic, business-critical investment, CFOs and CISOs play a critical role in articulating the significant ROI that robust security measures can deliver. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/3-things-cfo-mitigating-threats
-
Secret Blizzard Deploys Malware in ISP-Level AitM Attacks on Moscow Embassies
The Russian nation-state threat actor known as Secret Blizzard has been observed orchestrating a new cyber espionage campaign targeting foreign embassies located in Moscow by means of an adversary-in-the-middle (AitM) attack at the Internet Service Provider (ISP) level and delivering a custom malware dubbed ApolloShadow.”ApolloShadow has the capability to install a trusted root certificate to…
-
Attackers actively exploit critical zero-day in Alone WordPress Theme
Hackers exploit a critical vulnerability, tracked as CVE-2025-5394 (CVSS score of 9.8), in the Alone WordPress theme to hijack sites. Threat actors are actively exploiting a critical flaw, tracked as CVE-2025-5394 (CVSS score of 9.8), in the >>Alone Charity Multipurpose Non-profit WordPress Theme
-
Russia-affiliated Secret Blizzard conducting ongoing espionage against embassies in Moscow
A new Microsoft report finds that the long-running threat group has gained positions on state-aligned ISPs and Russian telecoms, while tricking foreign embassy staff to download custom malware. First seen on cyberscoop.com Jump to article: cyberscoop.com/russia-secret-blizzard-espionage-embassies-moscow/
-
Russia’s Secret Blizzard APT Gains Embassy Access via ISPs
An ongoing AitM campaign by the infamous Moscow-sponsored cyber threat actor has widened its scope, dropping the dangerous ApolloShadow custom backdoor malware thanks to lawful intercept systems. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/russia-secret-blizzard-apt-embassy-isps
-
Silver Fox Hackers Exploit Weaponized Google Translate Tools to Deliver Windows Malware
The Knownsec 404 Advanced Threat Intelligence Team has lately discovered increased activity from the Silver Fox cybercrime gang, which has been using fake versions of popular programs as weapons to spread malware in a complex cyber threat landscape. Tracing back to 2024, these attacks often masquerade as legitimate Google Translate interfaces, employing deceptive JavaScript redirects…