Tag: threat
-
Fighting AI Threats With Behavior-Based Awareness Training
Abnormal AI CEO Evan Reiser on Behavioral Anomalies, Personalized Phishing Training. Abnormal AI is rolling out behavior-driven AI tools that automate phishing awareness and data reporting. Co-founder and CEO Evan Reiser says the platform reflects a shift away from generic campaigns and manual dashboards toward contextual, real-time defense. First seen on govinfosecurity.com Jump to article:…
-
SafePay Ransomware Uses RDP and VPN Access to Infiltrate Organizational Networks
SafePay ransomware has become one of the most active and destructive threat actors in Q1 2025, a shocking development in the cybersecurity scene. According to the Acronis Threat Research Unit (TRU), SafePay has aggressively targeted over 200 victims worldwide, including managed service providers (MSPs) and small-to-midsize businesses (SMBs) across diverse industries. Unlike many ransomware groups…
-
US Sanctions Key Threat Actors Tied to North Korea’s Remote IT Worker Scheme
The Office of Foreign Assets Control (OFAC) of the U.S. Department of the Treasury has taken a strong stance against cyber-enabled financial schemes that support North Korea’s illicit weapons programs by imposing sanctions on Song Kum Hyok, a malevolent cyber actor connected to the hacking group Andariel of the Democratic People’s Republic of Korea (DPRK).…
-
Hackers Exploit GitHub to Distribute Malware Disguised as VPN Software
CYFIRMA has discovered a sophisticated cyberattack campaign in which threat actors are using GitHub to host and disseminate malware masquerading as genuine software. Masquerading as “Free VPN for PC” and “Minecraft Skin Changer,” these malicious payloads are designed to trick users into downloading a dangerous malware dropper named Launch.exe. Hosted on the GitHub repository github[.]com/SAMAIOEC,…
-
Cyberattacks on User Logins Jump 156%, Fueled by Infostealers and Phishing Toolkits
Identity-driven assaults have increased by a shocking 156% between 2023 and 2025, making up 59% of all confirmed threat instances in Q1 2025, according to data conducted by eSentire’s Threat Response Unit (TRU). This dramatic shift from traditional asset-focused exploits to sophisticated identity-centric campaigns underscores a fundamental change in adversarial tactics. Identity-Based Threats Cybercriminals are…
-
Forescout Vedere Labs shows >>vibe hacking<< isn't quite the threat it's made out to be… yet
Forescout’s Vedere Labs has published new research examining the real-world threat posed by generative AI in cyberattacks. While public concern is growing around >>vibe hacking>>, a term describing AI-driven, autonomous hacking, the research findings suggest the threat remains in its early stages. Based on more than 50 simulations involving generative AI models, researchers concluded that…
-
High-profile attacks underline ransomware threat
With the headlines dominated by recent incidents that have impacted retailers and the channel, the need remains for partners to continue to support customers First seen on computerweekly.com Jump to article: www.computerweekly.com/microscope/news/366627315/High-profile-attacks-underline-ransomware-threat
-
LLMs Fall Short in Vulnerability Discovery and Exploitation
Forescout found that most LLMs are unreliable in vulnerability research and exploit tasks, with threat actors still skeptical about using tools for these purposes First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/llms-fall-vulnerability-discovery/
-
Ransomware Volume Drops Even As Number Of Active Groups Surges: GuidePoint Security
Ransomware victim volume declined markedly in the second quarter of 2025 but the field of active threat groups continued to expand, suggesting the decrease in attacks may not be long-lived, according to GuidePoint Security research. First seen on crn.com Jump to article: www.crn.com/news/security/2024/ransomware-volume-drops-even-as-number-of-active-groups-surges-guidepoint-security
-
ServiceNow Platform Vulnerability Enables Attackers to Exfiltrate Sensitive Data
Security researchers have identified a critical vulnerability in ServiceNow’s widely-used enterprise platform that could enable attackers to extract sensitive data including personally identifiable information (PII), credentials, and financial records. The flaw, dubbed >>Count(er) Strike
-
AMD discloses new CPU flaws that can enable data leaks via timing attacks
Tags: access, attack, crowdstrike, cve, cvss, data, exploit, firmware, flaw, guide, leak, malware, microsoft, mitigation, risk, side-channel, strategy, supply-chain, threat, update, vulnerability, windowsCrowdStrike elevates threat classification despite CVSS scores: While AMD rates the vulnerabilities as medium and low severity based on attack complexity requirements, CrowdStrike has independently classified them as critical enterprise threats. The security firm specifically flagged CVE-2025-36350 and CVE-2025-36357 as “Critical information disclosure vulnerabilities in AMD processors,” despite both carrying CVSS scores of just 5.6.According…
-
Iranian APTs increased activity against US industries in late spring, researchers say
Iranian advanced persistent threat (APT) groups, including those tracked as MuddyWater and APT33, appeared to launch more attacks against U.S. industrial entities in May and June, according to a report from Nozomi Networks. First seen on therecord.media Jump to article: therecord.media/iran-state-backed-hackers-industrial-attacks-spring-2025
-
Patch Tuesday Kritische Schwachstelle könnte zum Netzwerkwurm mutieren
Saeed Abbasi, Senior Manager, Security Research, Qualys Threat Research Unit (TRU) zum Patch Tuesday:
-
AirMDR Tackles Security Burdens for SMBs With AI
This security startup provides managed detection and response services for small-to-midsized businesses to detect and address modern threats such as ransomware, phishing attacks, and malicious insiders. First seen on darkreading.com Jump to article: www.darkreading.com/cybersecurity-operations/airmdr-tackles-smb-security-burdens-with-ai
-
Hackers Exploit GeoServer RCE Flaw to Deploy Cryptocurrency Miners
Tags: attack, crypto, cve, cyber, data, exploit, flaw, hacker, intelligence, open-source, rce, remote-code-execution, threat, vulnerabilityThe AhnLab Security Intelligence Center (ASEC) has confirmed that unpatched GeoServer instances are still facing relentless attacks by threat actors exploiting a critical Remote Code Execution (RCE) vulnerability, identified as CVE-2024-36401. GeoServer, an open-source Geographic Information System (GIS) server developed in Java for spatial data processing, became a prime target after the vulnerability was disclosed…
-
MCP is fueling agentic AI, and introducing new security risks
Tags: access, ai, api, attack, authentication, best-practice, ceo, cloud, corporate, cybersecurity, gartner, injection, LLM, malicious, monitoring, network, office, open-source, penetration-testing, RedTeam, risk, service, supply-chain, technology, threat, tool, vulnerabilityMitigating MCP server risks: When it comes to using MCP servers there’s a big difference between developers using it for personal productivity and enterprises putting them into production use cases.Derek Ashmore, application transformation principal at Asperitas Consulting, suggests that corporate customers don’t rush on MCP adoption until the technology is safer and more of the…
-
An NVIDIA Container Bug & Chance to Harden Kubernetes
A container escape flaw involving the NVIDIA Container Toolkit could have enabled a threat actor to access AI datasets across tenants. First seen on darkreading.com Jump to article: www.darkreading.com/cloud-security/nvidia-container-bug-harden-kubernetes
-
Spyware Campaign Hits Russian Industrial Firms
Phishing Emails Disguise Malware as Contract Files. A Russian cybersecurity company is warning that hackers are targeting Russia’s industrial sector using a previously undocumented spyware, reeling them in with contract-themed emails lures. Kaspersky dubbed the spyware Batavia. but doesn’t attribute the campaign to a threat actor. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/spyware-campaign-hits-russian-industrial-firms-a-28928
-
Qantas confirms data breach impacts 5.7 million customers
Australian airline Qantas has confirmed that 5.7 million people have been impacted by a recent data breach, in which threat actors stole customers’ data. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/qantas-confirms-data-breach-impacts-57-million-customers/
-
Iran-linked hackers target US transportation, manufacturing firms
United States authorities have been warning of potential state-linked or hacktivist threats since the U.S. intervened in the Israel-Iran war. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/iranian-hackers-us-transportation-manufacturing-israel-nozomi/752612/
-
A NVIDIA Container Bug & Chance to Harden Kubernetes
A container escape flaw involving the NVIDIA Container Toolkit could have enabled a threat actor to access AI datasets across tenants. First seen on darkreading.com Jump to article: www.darkreading.com/cloud-security/nvidia-container-bug-harden-kubernetes
-
AMD warns of new Meltdown, Spectre-like bugs affecting CPUs
Low-severity bugs but infosec pros claim they are a ‘critical’ overall threat patch accordingly First seen on theregister.com Jump to article: www.theregister.com/2025/07/09/amd_tsa_side_channel/
-
French intel chief warns of evolving Russian hybrid operations, ‘existential threat’ to Europe
DGSE intelligence head Nicolas Lerner said Moscow’s tactics are evolving and increasingly include on-the-ground activities carried out by paid operatives. First seen on therecord.media Jump to article: therecord.media/french-intelligence-chief-russia-threat
-
Threat-Hunting für Behörden
Ein erfolgreicher Cyberangriff auf eine Behörde kann weitreichende Folgen haben, von der Lahmlegung kommunaler IT-Systeme bis zum Ausfall kritischer Infrastrukturen. Dienste und Systeme können über Wochen gestört sein, zudem droht der Verlust vertraulicher Daten. Um solchen Szenarien nicht schutzlos ausgeliefert zu sein, braucht es eine starke und vorausschauende Cybersicherheitsstrategie. Threat-Hunting ist dafür ein entscheidender und…
-
Hackers weaponize Shellter red teaming tool to spread infostealers
Hackers are abusing the legitimate red teaming tool Shellter to spread stealer malware after a licensed copy was leaked. Elastic Security Labs has identified several malware campaigns using the commercial AV/EDR evasion tool SHELLTER. The tool was originally built for legitimate red team operations, however, threat actors have now adopted it to bypass security measures…
-
Why Scattered Spider Persists as Major Threat to Insurers
Cybercrime gang Scattered Spider is the top suspect in several recent cyberattacks in the U.S. insurance sector, and it’s likely that threat actors could still be lurking in other insurers’ IT environments, said Peter McMurtrie of consulting firm West Monroe. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/interviews/scattered-spider-persists-as-major-threat-to-insurers-i-5487
-
Why Scattered Spider Persists as Major Threat to Insurers
Cybercrime gang Scattered Spider is the top suspect in several recent cyberattacks in the U.S. insurance sector, and it’s likely that threat actors could still be lurking in other insurers’ IT environments, said Peter McMurtrie of consulting firm West Monroe. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/interviews/scattered-spider-persists-as-major-threat-to-insurers-i-5487
-
Chinese Data Leak Reveals Salt Typhoon Contractors
China’s Hack-For-Hire Scene Disgorges Another Leak. The Chinese nation-state threat actor tracked as Salt Typhoon is operated by a clutch of private firms whose clients include multiple Chinese government agencies, finds analysis of leaked data by Spy Cloud. Researchers found a spreadsheet listing buyers, sellers and financial transaction details. First seen on govinfosecurity.com Jump to…