Tag: threat
-
What to know about ToolShell, the SharePoint threat under mass exploitation
Easy to exploit. Unauthenticated access. Massive reach. ToolShell has it all. First seen on arstechnica.com Jump to article: arstechnica.com/security/2025/07/what-to-know-about-toolshell-the-sharepoint-threat-under-mass-exploitation/
-
Feds Warn Health, Other Sectors of Interlock Threats
Healthcare Providers Are Among Dozens of Entities Hit Since Gang Emerged in 2024. U.S. authorities are warning of threats posed by double-extortion gang Interlock, which has been hitting an assortment of businesses across many industries, including healthcare and other critical infrastructure sectors, with a ransomware variant first seen in September 2024. First seen on govinfosecurity.com…
-
Microsoft Integrates Data Lake With Sentinel SIEM
Microsoft Sentinel Data Lake aims to provide inexpensive storage for large volumes of telemetry, while threat intelligence will be included with Defender XDR at no extra cost. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/microsoft-integrates-data-lake-with-sentinel-siem
-
CISO Conversations: How IT and OT Security Worlds Are Converging
Dark Reading’s Kelly Jackson Higgins interviews Carmine Valente, Deputy CISO at Con Edison, about his role at the New York-based electric utility and the state of IT and OT security. Valente highlights current threats like ransomware and supply chain attacks, as well as the impact of AI on both defense and threats. First seen on…
-
Critical Infrastructure Security Is a Critical Concern
To be truly resilient in the ever-growing threat landscape, organizations need to balance protection with preparation. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/critical-infrastructure-security-critical-concern
-
Trump AI plan calls for cybersecurity assessments, threat info-sharing
It remains unclear how federal agencies depleted by layoffs will be able to implement the strategy’s ambitious vision, which includes an ISAC dedicated to AI. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/white-house-artificial-intelligence-action-plan-cybersecurity-trump/753856/
-
US Nuclear Agency Hacked in Microsoft SharePoint Frenzy
Threat actors are piling on the zero-day vulnerabilities in SharePoint, including at least three Chinese nation-state cyber-espionage groups. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/us-nuclear-agency-hacked-microsoft-sharepoint
-
SharePoint under fire: new ToolShell attacks target enterprises
While SentinelOne did not attribute the attack to a specific threat actor, The Washington Post linked it to China-nexus acors. On July 19, Microsoft confirmed active exploitation of a zero-day vulnerability, tracked as CVE-2025-53770 in on-prem SharePoint Servers. The IT giant issued emergency patches for SharePoint Subscription Edition and 2019, with 2016 updates pending. Microsoft…
-
Microsoft confirms China link to SharePoint hacks
Microsoft confirms two known China-nexus threat actors, and one other suspected state-backed hacking group, are exploiting vulnerabilities in SharePoint Server First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366628014/Microsoft-confirms-China-link-to-SharePoint-hacks
-
Chinese cyber spies among those linked to SharePoint attacks
Exploitation of the ToolShell RCE zero-day in Microsoft SharePoint continues to gather pace, with evidence emerging of exploitation by nation state-backed threat actors First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366627767/Chinese-cyber-spies-among-those-linked-to-SharePoint-attacks
-
Is Ransomware Dying? Don’t Break Out the Champagne Just Yet
We’re seeing fewer attacks, but that doesn’t mean we’re safer. The latest data from NCC Group shows traditional ransomware is down, but threat actors are regrouping, rebranding, and rearming with AI and advanced social engineering. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/07/is-ransomware-dying-dont-break-out-the-champagne-just-yet/
-
Microsoft pins on-prem SharePoint attacks on Chinese threat actors
As Microsoft continues to update its customer guidance for protecting on-prem SharePoint servers against the latest in-the-wild attacks, more security firms have begun sharing … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/07/22/microsoft-pins-sharepoint-attacks-cve-2025-53770/
-
Microsoft Patches SharePoint Flaws as Hackers Rush to Exploit Them
As Microsoft puts the final patch in place, a growing number of hackers, including several China state-sponsored threat groups, are quickly pushing forward to exploit the security flaws that will allow them compromise on-premises SharePoint servers to steal data and maintain persistence. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/07/microsoft-patches-sharepoint-flaws-as-hackers-rush-to-exploit-them/
-
How SWIS school strengthened staff online safety and compliance with Meta1st
Against the backdrop of escalating cyberattack threats, schools face growing pressure to ensure the safety, compliance and digital literacy of both students and staff. At SWIS school, a private school based near London, this challenge was recognised early and acted upon with intention. The school’s leadership team understood that protecting students goes beyond traditional The…
-
Lapsed CISA contract impedes national lab’s threat-hunting operations
The CyberSentry program remains operational, according to CISA, with analysts outside the lab continuing to review sensor data. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/cisa-cybersentry-llnl-analysis-contract/753834/
-
US nuclear weapons agency hacked in Microsoft SharePoint attacks
Unknown threat actors have breached the National Nuclear Security Administration’s network in attacks exploiting a recently patched Microsoft SharePoint zero-day vulnerability chain. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/us-nuclear-weapons-agency-hacked-in-microsoft-sharepoint-attacks/
-
Mimo Targets Magento CMS to Steal Card Details and Monetize Bandwidth
The Datadog Security Research team has uncovered the Mimo threat actor also known as Mimo’lette or Hezb expanding its operations from Craft CMS to Magento CMS. Previously documented for deploying cryptominers via public-facing vulnerabilities, Mimo now exploits undetermined PHP-FPM flaws in Magento installations to gain initial access, marking a tactical shift toward broader platform targeting.…
-
Malicious LNK File Posing as Credit Card Security Email Steals User Data
Tags: authentication, credit-card, cyber, data, email, exploit, finance, malicious, powershell, threatThreat actors have deployed a malicious LNK file masquerading as a credit card company’s security email authentication pop-up to pilfer sensitive user information. The file, named >>card_detail_20250610.html.lnk,
-
Threat Actor Mimo Targets Magento and Docker to Deploy Crypto Miners and Proxyware
The threat actor behind the exploitation of vulnerable Craft Content Management System (CMS) instances has shifted its tactics to target Magento CMS and misconfigured Docker instances.The activity has been attributed to a threat actor tracked as Mimo (aka Hezb), which has a long history of leveraging N-day security flaws in various web applications to deploy…
-
Warning to feds: US infrastructure is under silent attack
Tags: attack, awareness, breach, business, ceo, cisa, control, cyber, cybersecurity, data, defense, exploit, government, Hardware, infrastructure, intelligence, risk, technology, theft, threat, vulnerabilityIT and OT are fundamentally different: Robert M. Lee, CEO and co-founder of cybersecurity company Dragos, Inc., also spoke at the hearing, pointing out that enterprises and regulators must “recognize and account for” the differences between information technology (IT) and OT systems.”IT and OT systems differ fundamentally in both purpose and operation,” he said. “While…
-
Microsoft Links Ongoing SharePoint Exploits to Three Chinese Hacker Groups
Microsoft has formally tied the exploitation of security flaws in internet-facing SharePoint Server instances to two Chinese hacking groups called Linen Typhoon and Violet Typhoon as early as July 7, 2025, corroborating earlier reports.The tech giant said it also observed a third China-based threat actor, which it tracks as Storm-2603, weaponizing the flaws as well…
-
UK proposal would forbid ransom payments by gov’t agencies, but will it meaningfully decrease ransomware attacks?
Tags: attack, backup, business, ceo, dark-web, data, finance, government, group, hacker, intelligence, law, ransom, ransomware, threatBusinesses often want to pay ransom: Fred Chagnon, principal research director at Info-Tech Research Group noted that, from a business continuity perspective, it can make sense to pay the ransom.”Paying the ransom can sometimes be the quickest and least damaging path to restoring operations, especially if backups are compromised or recovery is prohibitively slow. While…
-
Credential Theft and Remote Access Surge as AllaKore, PureRAT, and Hijack Loader Proliferate
Mexican organizations are still being targeted by threat actors to deliver a modified version of AllaKore RAT and SystemBC as part of a long-running campaign. The activity has been attributed by Arctic Wolf Labs to a financially motivated hacking group called Greedy Sponge. It’s believed to be active since early 2021, indiscriminately targeting a wide…
-
Dell demonstration platform breached by World Leaks extortion group
Tags: access, attack, breach, data, data-breach, defense, encryption, exploit, extortion, finance, group, insurance, international, leak, network, ransomware, risk, risk-management, strategy, threat, toolLimited impact but strategic implications: Dell emphasized that the breached platform is architecturally separated from customer-facing networks and internal production systems. “Data used in the solution center is primarily synthetic (fake) data, publicly available datasets used solely for product demonstration purposes or Dell scripts, systems data, non-sensitive information, and testing outputs,” the report added, quoting…
-
Russian Threat Actors Target NGOs with New OAuth Phishing Tactics
A new wave of phishing attacks exploiting Microsoft 365 OAuth tools has been observed impersonating diplomats to steal access codes First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/russian-hackers-target-ngos-oauth/
-
Microsoft SharePoint zero-day attacks pinned on China-linked ‘Typhoon’ threat groups
Linen Typhoon, Violet Typhoon and Storm-2603 are behind the initial attack spree that erupted over the weekend. Other threat groups are now following suit. First seen on cyberscoop.com Jump to article: cyberscoop.com/microsoft-sharepoint-zero-days-china-typhoon/
-
SharePoint ‘ToolShell’ Vulnerabilities Exploited by Chinese Nation-State Hackers
Microsoft has observed three China-based threat actors, Linen Typhoon, Violet Typhoon and Storm-2603, exploiting the SharePoint vulnerabilities First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/sharepoint-toolshell-chinese/