Tag: threat
-
New Gunra Ransomware Linux Variant Launches 100 Encryption Threads with Partial Encryption Feature
The new Gunra group has expanded its attack surface beyond Windows PCs by releasing a Linux version of their virus, which was initially discovered in April 2025. This is a major uptick in the ransomware ecosystem. This development underscores the group’s strategic pivot toward cross-platform targeting, inspired by predecessors like Conti ransomware. Trend Micro’s threat…
-
Cisco Talos at Black Hat 2025: Briefings, booth talks and what to expect
Cisco Talos is back at Black Hat with new research, threat detection overviews and opportunities to connect with our team. Whether you’re interested in what we’re seeing in the threat landscape, detection engineering or real-world incident response, here’s where and how to find us. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/cisco-talos-at-black-hat-2025-briefings-booth-talks-and-what-to-expect/
-
Google Launches DBSC Open Beta in Chrome and Enhances Patch Transparency via Project Zero
Google has announced that it’s making a security feature called Device Bound Session Credentials (DBSC) in open beta to ensure that users are safeguarded against session cookie theft attacks.DBSC, first introduced as a prototype in April 2024, is designed to bind authentication sessions to a device so as to prevent threat actors from using stolen…
-
Critical SAP flaw exploited to launch Auto-Color Malware attack on U.S. company
Hackers exploited a SAP NetWeaver bug to deploy upgraded Auto-Color Linux malware in an attack on U.S. chemicals firm. Cybersecurity firm Darktrace reported that threat actors exploited a SAP NetWeaver flaw, tracked as CVE-2025-31324, to deploy Auto-Color Linux malware in a U.S. chemicals firm attack. >>In April 2025, Darktrace identified an Auto-Color backdoor malware attack…
-
Hackers Target SAP NetWeaver to Deploy New Auto-Color Linux Malware
Cybersecurity researchers at Darktrace have uncovered a sophisticated attack targeting a US-based chemicals company, marking the first observed instance of threat actors exploiting SAP NetWeaver vulnerabilities to deploy Auto-Color backdoor malware. The incident, which occurred over three days in April 2025, demonstrates an alarming evolution in cyber attack tactics combining enterprise software exploitation with advanced…
-
How CISOs can scale down without compromising security
Tags: breach, business, ciso, compliance, control, cybersecurity, data, detection, finance, framework, gartner, governance, intelligence, jobs, metric, open-source, regulation, resilience, risk, soc, strategy, threat, tool, training, vulnerabilityStrategic risk (high, medium, low): What’s the actual exposure if this control fails?Business alignment: Which functions are enabling revenue, customer trust, or compliance?No-brainers: These are redundant tools, shelfware, or “security theatre” controls that look good on paper but deliver no measurable protection.For this assessment, Mahdi brings together a cross-functional team that includes business unit leaders,…
-
Prepping for the quantum threat requires a phased approach to crypto agility
Tags: access, ceo, ciso, computing, crypto, cryptography, cybersecurity, encryption, firmware, government, Hardware, identity, network, nist, open-source, software, supply-chain, threat, tool, vulnerabilityMissing pieces: Michael Smith, field CTO at DigiCert, noted that the industry is “yet to develop a completely PQC-safe TLS protocol.””We have the algorithms for encryption and signatures, but TLS as a protocol doesn’t have a quantum-safe session key exchange and we’re still using Diffie-Hellman variants,” Smith explained. “This is why the US government in…
-
Industry experts warn crypto infrastructure is ‘creaking’
A new report from experts at HSBC, Thales and InfoSec Global claims decades-old cryptographic systems are failing, putting businesses at risk from current vulnerabilities and the threat from quantum computing First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366628242/Industry-experts-warn-crypto-infrastructure-is-creaking
-
Hackers Exploit SAP Vulnerability to Breach Linux Systems and Deploy Auto-Color Malware
Threat actors have been observed exploiting a now-patched critical SAP NetWeaver flaw to deliver the Auto-Color backdoor in an attack targeting a U.S.-based chemicals company in April 2025.”Over the course of three days, a threat actor gained access to the customer’s network, attempted to download several suspicious files and communicated with malicious infrastructure linked to…
-
Scattered Spider Hacker Arrests Halt Attacks, But Copycat Threats Sustain Security Pressure
Google Cloud’s Mandiant Consulting has revealed that it has witnessed a drop in activity from the notorious Scattered Spider group, but emphasized the need for organizations to take advantage of the lull to shore up their defenses.”Since the recent arrests tied to the alleged Scattered Spider (UNC3944) members in the U.K., Mandiant Consulting hasn’t observed…
-
New Microsoft Guidance Targets Defense Against Indirect Prompt Injection
Microsoft has unveiled new guidance addressing one of the most pressing security challenges facing enterprise AI deployments: indirect prompt injection attacks. This emerging threat vector has become the top entry in the OWASP Top 10 for LLM Applications & Generative AI 2025, prompting the tech giant to develop a multi-layered defense strategy spanning prevention, detection,…
-
Deutschland meldet weltweit größten Fachkräftemangel bei Cyber Threat Intelligence
Google Cloud Security hat gemeinsam mit Forrester neue Erkenntnisse aus dem aktuellen Report »Threat Intelligence Benchmark: Stop Reacting; Start Anticipating« veröffentlicht [1]. Die Ergebnisse zeigen eine deutliche Diskrepanz zwischen der Bedrohungstransparenz und der Vorbereitung auf Führungsebene in einer Bedrohungslage, die sich rasant weiterentwickelt. Weltweit wurden über 1.500 Security-Führungskräfte auf C-Level befragt darunter mehr… First seen…
-
FBI, CISA Warn About Scattered Spider Cyberattacks
The FBI and CISA issued updated guidance today on the Scattered Spider threat group, including information on recent attack techniques such as encrypting VMware ESXi servers with DragonForce ransomware. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/fbi-cisa-warn-about-scattered-spider/
-
Unveiling 0bj3ctivityStealer’s Execution Chain: New Capabilities and Exfiltration Techniques Exposed
In the ever-evolving infostealer landscape, 0bj3ctivityStealer emerges as a formidable threat, blending advanced obfuscation with targeted data exfiltration. Discovered earlier this year by HP Wolf Security researchers, this .NET-based malware has been observed in proactive threat hunting by the Trellix Advanced Research Center, revealing a novel phishing-driven campaign. The infection initiates through spearphishing emails themed…
-
New XWorm V6 Variant with Anti-Analysis Features Targeting Windows Users in Active Attacks
Netskope Threat Labs has uncovered a new iteration of the XWorm malware, version 6.0, which demonstrates ongoing development by threat actors and introduces sophisticated enhancements aimed at evading detection and maintaining persistence on Windows systems. This variant builds upon previously documented infection chains, incorporating advanced anti-analysis techniques and process protection mechanisms that make it particularly…
-
The Hidden Threat of Rogue Access
With the right IGA tools, governance policies, and risk thresholds, enterprises can continuously detect and act on rogue access before attackers do. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/hidden-threat-rogue-access
-
Lazarus Subgroup ‘TraderTraitor’ Targets Cloud Platforms and Contaminates Supply Chains
Tags: cloud, cyber, cybersecurity, group, lazarus, mandiant, microsoft, north-korea, supply-chain, threatThe North Korean state-sponsored advanced persistent threat (APT) known as TraderTraitor, a subgroup of the notorious Lazarus Group, has emerged as a formidable actor specializing in digital asset heists. Tracked under aliases such as UNC4899, Jade Sleet, TA444, and Slow Pisces by various cybersecurity firms including Mandiant, Microsoft, Proofpoint, and Unit42, TraderTraitor operates under the…
-
Orange, France’s largest telecoms company, hit by cyberattack
Customers of French telecommunications provider Orange might see disruptions related to a cyberattack, the company said, without providing further details about the incident or threat actor. First seen on therecord.media Jump to article: therecord.media/orange-telecom-france-cyberattack
-
Cybercriminals Use Fake Apps to Steal Data and Blackmail Users Across Asia’s Mobile Networks
Cybersecurity researchers have discovered a new, large-scale mobile malware campaign that’s targeting Android and iOS platforms with fake dating, social networking, cloud storage, and car service apps to steal sensitive personal data.The cross-platform threat has been codenamed SarangTrap by Zimperium zLabs. Users in South Korea appear to be the primary focus.”This extensive campaign involved First…
-
How FinServ Firms Can Navigate Secure Open Finance in 2025 and Beyond
Banks Must Secure APIs, Vet Partners and Prepare for Open Finance Threats in 2025 Open finance is revolutionizing banking, but it’s also expanding the attack surface. Discover the critical API, data privacy and third-party risks facing financial institutions in 2025 – and how to build a secure future. First seen on govinfosecurity.com Jump to article:…
-
PCI DSS 4.0.1 Pushes E-Commerce to Secure Apps Fast
New PCI DSS Rules Raise the Bar, Make App Security a Mandate PCI DSS 4.0.1 raises the stakes for retailers and e-commerce providers, turning app security best practices into hard requirements. With sophisticated threats on the rise, businesses must adopt integrated solutions to protect digital experiences end-to-end. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/blogs/pci-dss-401-pushes-e-commerce-to-secure-apps-fast-p-3914
-
Lionishackers Exfiltrate Sensitive Corporate Databases for Sale on the Dark Web
Outpost24’s threat intelligence researchers have uncovered the operations of Lionishackers, a financially motivated cyber threat actor specializing in the exfiltration and illicit sale of corporate databases. This group employs an opportunistic approach to target selection, with a notable preference for entities in Asian countries such as Thailand, Syria, and India. While primarily driven by profit,…
-
New macOS Vulnerability Allows Attackers to Steal Private Files by Bypassing TCC
Microsoft Threat Intelligence has uncovered a critical macOS vulnerability that enables attackers to bypass Apple’s Transparency, Consent, and Control (TCC) framework, potentially exposing sensitive user data including files protected by privacy controls and information cached by Apple Intelligence. Vulnerability Overview The newly discovered vulnerability, dubbed >>Sploitlight
-
Threat Actors Use Phishing to Target Belgian Grand Prix Fans and Teams
Cybersecurity experts have pointed to an increase in sophisticated threat actor activity following the July 27 2025 Belgian Grand Prix at Spa-Francorchamps, which takes advantage of the event’s worldwide attraction. Formula 1’s reliance on advanced telemetry systems, which process real-time data like tire thermodynamics and engine metrics for strategic optimization, positions teams as high-value targets…
-
Threat Actors Use Phishing to Target Belgian Grand Prix Fans and Teams
Cybersecurity experts have pointed to an increase in sophisticated threat actor activity following the July 27 2025 Belgian Grand Prix at Spa-Francorchamps, which takes advantage of the event’s worldwide attraction. Formula 1’s reliance on advanced telemetry systems, which process real-time data like tire thermodynamics and engine metrics for strategic optimization, positions teams as high-value targets…
-
Microsoft Says SharePoint Attacks Now Include Ransomware
A China-linked threat actor has been observed exploiting SharePoint servers to deliver ransomware, according to Microsoft researchers, in the latest sign of worsening attacks against on-premises SharePoint Server customers. First seen on crn.com Jump to article: www.crn.com/news/security/2025/microsoft-says-sharepoint-attacks-now-include-ransomware
-
vCISO In Action: Navigating Cybersecurity Leadership Beyond Office Walls
With two decades in the industry, Emily O’Carroll reflects on how the threat landscape has evolved, the difference between in-house and virtual CISO work, and why mentoring and finding personal balance are just as important as managing risk. First seen on crn.com Jump to article: www.crn.com/news/security/2025/vciso-in-action-navigating-cybersecurity-leadership-beyond-office-walls1