Tag: threat
-
Microsoft Says SharePoint Attacks Now Include Ransomware
A China-linked threat actor has been observed exploiting SharePoint servers to deliver ransomware, according to Microsoft researchers, in the latest sign of worsening attacks against on-premises SharePoint Server customers. First seen on crn.com Jump to article: www.crn.com/news/security/2025/microsoft-says-sharepoint-attacks-now-include-ransomware
-
vCISO In Action: Navigating Cybersecurity Leadership Beyond Office Walls
With two decades in the industry, Emily O’Carroll reflects on how the threat landscape has evolved, the difference between in-house and virtual CISO work, and why mentoring and finding personal balance are just as important as managing risk. First seen on crn.com Jump to article: www.crn.com/news/security/2025/vciso-in-action-navigating-cybersecurity-leadership-beyond-office-walls1
-
UNC3886 Exploits Multiple 0-Day Bugs in VMware vCenter, ESXi, and Fortinet FortiOS
The advanced persistent threat group UNC3886 has escalated its sophisticated cyber espionage campaign by exploiting multiple zero-day vulnerabilities across critical infrastructure platforms, including VMware vCenter, ESXi hypervisors, and Fortinet FortiOS systems. This revelation comes as Singapore’s Coordinating Minister for National Security confirmed that the nation faces a highly sophisticated threat actor targeting essential services, with…
-
Microsoft uncovers macOS flaw allowing bypass TCC protections and exposing sensitive data
Microsoft found a macOS flaw letting attackers access private data from protected areas like Downloads and Apple Intelligence caches. Microsoft Threat Intelligence researchers discovered a macOS vulnerability that could allow attackers to steal private data of files normally protected by Transparency, Consent, and Control (TCC). Apple’s Transparency, Consent, and Control framework in macOS is designed…
-
Security pros are drowning in threat-intel data and it’s making everything more dangerous
Plus, 60% don’t have enough analysts to make sense of it First seen on theregister.com Jump to article: www.theregister.com/2025/07/28/security_pros_drowning_in_threatintel/
-
Corelight Uses Gen AI to Power Smarter Threat Detection
SaaS Enhancements Aim to Boost Network Detection, Response for Small Security Teams. Corelight’s SaaS platform Investigator is designed to bring scalable network detection and response to smaller security teams. CEO Brian Dye says Gen AI workflows and enriched network context help defenders identify threats faster and with greater confidence than ever. First seen on govinfosecurity.com…
-
Microsoft SharePoint Hackers Switch Gears to Spread Ransomware
Threat actors exploit SharePoint flaws to access internal systems, steal sensitive data, and carry out surveillance, impersonation, and extortion. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/microsoft/sharepoint-vulnerabilities-exploitation/
-
Oyster Backdoor Disguised as PuTTY and KeyPass Targets IT Admins via SEO Poisoning
Threat actors have been using trojanized versions of well-known IT tools like PuTTY and WinSCP to spread the Oyster backdoor, also known as Broomstick or CleanupLoader, in a sophisticated malvertising and SEO poisoning campaign that Arctic Wolf researchers first noticed in early June 2025. There have also been hints that KeyPass has been involved in…
-
UNC3886 Hackers Target Singapore’s Critical Infrastructure by Exploiting 0-Day Vulnerabilities
Tags: china, cyber, cyberattack, exploit, finance, government, group, hacker, infrastructure, mandiant, service, threat, vulnerability, zero-daySingapore’s critical infrastructure sectors, including energy, water, telecommunications, finance, and government services, are facing an active cyberattack from UNC3886, a sophisticated China-linked advanced persistent threat (APT) group renowned for leveraging zero-day exploits and custom malware. First identified by Mandiant in 2022, UNC3886 has been operational since at least 2021, with confirmed activities exploiting vulnerabilities in…
-
Hackers Breach Toptal GitHub, Publish 10 Malicious npm Packages With 5,000 Downloads
Tags: access, attack, authentication, breach, github, hacker, malicious, software, supply-chain, threatIn what’s the latest instance of a software supply chain attack, unknown threat actors managed to compromise Toptal’s GitHub organization account and leveraged that access to publish 10 malicious packages to the npm registry.The packages contained code to exfiltrate GitHub authentication tokens and destroy victim systems, Socket said in a report published last week. In…
-
CISA flags PaperCut RCE bug as exploited in attacks, patch now
CISA warns that threat actors are exploiting a high-severity vulnerability in PaperCut NG/MF print management software, which can allow them to gain remote code execution in cross-site request forgery (CSRF) attacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisa-flags-papercut-rce-bug-as-exploited-in-attacks-patch-now/
-
FBI alerts tie together threats of cybercrime, physical violence from The Com
Officials said thousands of people, typically between 11 and 25 years old, are engaged in a growing and evolving online threat to commit crime for money, retaliation, ideology, sexual gratification and notoriety. First seen on cyberscoop.com Jump to article: cyberscoop.com/fbi-warning-the-com-cybercrime-extortion-violence/
-
Der Fachkräftemangel bei CyberIntelligence ist in Deutschland signifikant
Google Cloud Security hat gemeinsam mit Forrester neue Erkenntnisse aus dem aktuellen Report veröffentlicht. Die Ergebnisse zeigen eine deutliche Diskrepanz zwischen der Bedrohungstransparenz und der Vorbereitung auf Führungsebene in einer Bedrohungslage, die sich rasant weiterentwickelt. In Deutschland kämpfen Security-Teams besonders stark mit einem Mangel an qualifizierten Threat-Analysten […] First seen on netzpalaver.de Jump to article:…
-
Free Autoswagger Tool Finds the API Flaws Attackers Hope You Miss
Exposed API documentation is a gift-wrapped roadmap for threat actors. The free Autoswagger tool from Intruder scans for exposed docs and flags endpoints with broken access controls”, before attackers find them. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/free-tool-autoswagger-finds-the-api-flaws-attackers-hope-you-miss/
-
LLM Honeypots Deceive Hackers into Exposing Attack Methods
Tags: ai, attack, cyber, cybercrime, cybersecurity, hacker, intelligence, LLM, strategy, technology, threatCybersecurity researchers have successfully deployed artificial intelligence-powered honeypots to trick cybercriminals into revealing their attack strategies, demonstrating a promising new approach to threat intelligence gathering. The innovative technique uses large language models (LLMs) to create convincing fake systems that lure hackers into exposing their methods and infrastructure. Revolutionary Deception Technology The breakthrough involves Beelzebub, a…
-
âš¡ Weekly Recap, SharePoint Breach, Spyware, IoT Hijacks, DPRK Fraud, Crypto Drains and More
Some risks don’t breach the perimeter”, they arrive through signed software, clean resumes, or sanctioned vendors still hiding in plain sight.This week, the clearest threats weren’t the loudest”, they were the most legitimate-looking. In an environment where identity, trust, and tooling are all interlinked, the strongest attack path is often the one that looks like…
-
Free Tool Autoswagger Finds The API Flaws Attackers Hope You Miss
Exposed API documentation is a gift-wrapped roadmap for threat actors. The free Autoswagger tool from Intruder scans for exposed docs and flags endpoints with broken access controls”, before attackers find them. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/free-tool-autoswagger-finds-the-api-flaws-attackers-hope-you-miss/
-
NPM ‘is’ Package with 2.8M Weekly Downloads Exploited in Attack on Developers
The popular npm package ‘is’, which has about 2.8 million weekly downloads, has been taken over by threat actors in a sophisticated escalation of a phishing effort that was first disclosed last Friday. The attack began with emails spoofing npm’s support@npmjs.org address, directing developers to a typosquatted domain, npnjs.com a near-identical proxy of the legitimate…
-
Third-Party Breach Impacts Majority of Allianz Life US Customers
Insurance firm Allianz Life said that a threat actor accessed personally identifiable information of the majority of its 1.4 million US customers First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/third-party-breach-allianz/
-
Chinese ‘Fire Ant’ spies start to bite unpatched VMware instances
Tunnelling allowed lateral movement: Once inside, Fire Ant bypassed network segmentation by exploiting CVE-2022-1388 in F5 BIG-IP devices. This allowed them to deploy encrypted tunnels such as Neo-reGeorg web shells to reach isolated environments, even leveraging IPv6 to evade IPv4 filters.”The threat actor demonstrated a deep understanding of the target environment’s network architecture and policies,…
-
Chinese ‘Fire Ant’ spies start to bite unpatched VMware instances
Tunnelling allowed lateral movement: Once inside, Fire Ant bypassed network segmentation by exploiting CVE-2022-1388 in F5 BIG-IP devices. This allowed them to deploy encrypted tunnels such as Neo-reGeorg web shells to reach isolated environments, even leveraging IPv6 to evade IPv4 filters.”The threat actor demonstrated a deep understanding of the target environment’s network architecture and policies,…
-
Inside Laundry Bear: Unveiling Infrastructure, Tactics, and Procedures
Dutch intelligence agencies AIVD and MIVD, alongside Microsoft Threat Intelligence, have identified Laundry Bear also tracked as Void Blizzard as a sophisticated Russian state-sponsored advanced persistent threat (APT) group active since at least April 2024. This actor has focused on espionage operations against NATO countries, Ukraine, and various organizations including the Dutch police, a Ukrainian…
-
UNC3944 Ransomware Attacks Target U.S. Infrastructure via VMware Exploits
Tags: attack, cybercrime, cybersecurity, exploit, google, group, hacking, infrastructure, intelligence, ransomware, threat, vmwareA financially driven cybercrime group known as UNC3944 has launched a coordinated and highly targeted hacking campaign that ends with ransomware against major U.S. industries, according to a joint report by Google’s Threat Intelligence Group (GTIG) and cybersecurity firm Mandiant…. First seen on sensorstechforum.com Jump to article: sensorstechforum.com/unc3944-ransomware-attacks-vmware-exploits/
-
Threat Actors Claim Breach of Airpay Payment Gateway
Cybercriminals have reportedly claimed a successful breach of Airpay, an Indian payment gateway service, raising serious concerns about the security of financial data and customer information. The allegations surfaced on underground forums where threat actors are allegedly offering access to sensitive data for sale, though the full extent and validity of the claimed breach remains…
-
Emerging cybersecurity needs: What the market is telling us
Default-deny, strict controls, and real-time monitoring: how to stop threats before they start. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/spons/emerging-cybersecurity-needs-what-the-market-is-telling-us/753727/
-
New “ToolShell” Exploit Targets SharePoint Servers for Full Takeover
Tags: attack, cve, cyber, exploit, microsoft, remote-code-execution, threat, vulnerability, zero-dayFortiGuard Labs has identified a critical new exploit chain dubbed >>ToolShell
-
Data resilience critical as ransomware attacks target backups
With more threat actors targeting backup repositories to ensure a payday, Veeam urges organisations to threat data resilience as a competitive advantage, not just an insurance policy First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366628213/Data-resilience-critical-as-ransomware-attacks-target-backups
-
Darkweb das verkannte Security-Tool
Tags: crypto, cyberattack, cybercrime, exploit, hacker, intelligence, leak, mail, malware, ransomware, service, threat, tool, vulnerability, zero-dayEin Besuch im Darkweb kann der IT-Sicherheit zuträglich sein.Ist vom Darkweb die Rede, weckt das bei den meisten Menschen dunkle Assoziationen von einem florierenden Cyberuntergrund, in dem (unter anderem) mit Waffen, Drogen und Zugangsdaten gehandelt wird. Das trifft zwar durchaus zu allerdings eröffnet das Darkweb Unternehmen, beziehungsweise Security-Spezialisten und -Forschern, auch einige interessante Möglichkeiten, Schaden…