Tag: threat
-
Guardz Snags $56M to Grow AI Cybersecurity Platform for MSPs
Startup Boosts AI-Driven Detection, MSP Channel Outreach and Hiring With Series B. Guardz has secured $56 million to deepen AI-powered threat detection and enhance automation for MSPs. The Series B funding will support platform engineering, channel marketing and operational scaling as Miami-based Guardz targets a simplified and consolidated cybersecurity future. First seen on govinfosecurity.com Jump…
-
‘No Kings’ Protests, Citizen-Run ICE Trackers Trigger Intelligence Warnings
Army intelligence analysts are monitoring civilian-made ICE tracking tools, treating them as potential threats, as immigration protests spread nationwide. First seen on wired.com Jump to article: www.wired.com/story/no-kings-protests-citizen-run-ice-trackers-trigger-intelligence-warnings/
-
Ransomware Group Threatens to Dump Paraguayan Citizens’ Data
7.2 Million Individuals’ Personal Data Being Held to Ransom by Threat Actor. A data-leak group extortion is shaking down the government of Paraguay for a ransom payment worth $7.4 million, or $1 for every one of the country’s citizens. The group, calling itself Brigada Cyber PMC, claims the stolen data includes people’s personally identifiable information.…
-
Threat Actor Abuses TeamFiltration for Entra ID Account Takeovers
Proofpoint researchers discovered a large-scale campaign using the open source penetration-testing framework that has targeted more than 80,000 Microsoft accounts. First seen on darkreading.com Jump to article: www.darkreading.com/cloud-security/threat-actor-teamfiltration-entra-id-attacks
-
Former CISA and NCSC Heads Warn Against Glamorizing Threat Actor Names
Jen Easterly and Ciaran Martin called for a universal, vendor-neutral cyber threat actor naming system First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/former-cisa-ncsc-threat-actor-names/
-
ISMG Editors: Gartner Security & Risk Management Summit Recap
Security Leadership in Focus – From AI Risks to Cloud Responsibility. AI fragmentation, non-human identities and nation-state threats dominated conversations at the Gartner Security & Risk Management Summit. ISMG editors discuss how the event stood out for its vendor-neutral focus and strategic discussions tailored for senior security decision-makers. First seen on govinfosecurity.com Jump to article:…
-
Fog ransomware gang abuses employee monitoring tool in unusual multi-stage attack
Tags: attack, china, cloud, control, corporate, encryption, espionage, exploit, google, group, intelligence, microsoft, monitoring, network, open-source, penetration-testing, ransomware, service, threat, toolOpen-source pen testers for executing commands: Another peculiarity observed in the attack was the use of open-source penetration testing tools, like GC2 and Adaptix C2, rarely seen with ransomware attacks.Google Command and Control (GC2) is an open-source post-exploitation tool that allows attackers to control compromised systems using legitimate cloud services like Google Sheets and Google…
-
CTEM is the New SOC: Shifting from Monitoring Alerts to Measuring Risk
Introduction: Security at a Tipping PointSecurity Operations Centers (SOCs) were built for a different era, one defined by perimeter-based thinking, known threats, and manageable alert volumes. But today’s threat landscape doesn’t play by those rules. The sheer volume of telemetry, overlapping tools, and automated alerts has pushed traditional SOCs to the edge. Security teams are…
-
Developers Beware Sophisticated Phishing Scams Exploit GitHub Device Code Flow to Hijack Tokens
A sophisticated and increasing wave of cyberattacks now targets software developers through a little-known yet legitimate GitHub feature: the OAuth 2.0 Device Code Flow. Security experts, notably from Praetorian, have warned that threat actors are leveraging this mechanism to trick developers into surrendering access to their most sensitive code repositories and CI/CD pipelines. The attacks…
-
Graphite Spyware Uses iOS Zero-Click Flaw to Target Journalists
Security researchers at Citizen Lab have uncovered the first forensic evidence linking Paragon’s Graphite mercenary spyware to zero-click attacks on journalists’ iPhones. The campaigns exploited a now-patched iMessage vulnerability (CVE-2025-43200) to compromise devices running iOS 18.2.1, highlighting the persistent threat of state-aligned surveillance against civil society Technical Overview of the Attack Chain According to the…
-
JSFireTruck Obfuscation Helps Cybercriminals Hijack Trusted Sites with Malicious JavaScript
A sophisticated and extensive cyber attack campaign has been uncovered, in which threat actors are compromising legitimate websites to inject highly obfuscated JavaScript code. Dubbed “JSFireTruck,” this obfuscation technique enables cybercriminals to quietly redirect unsuspecting visitors to malicious sites capable of delivering malware, executing exploits, and serving unwanted advertisements. The campaign, detected across over 200,000…
-
How to log and monitor PowerShell activity for suspicious scripts and commands
Block executable content from email client and webmailBlock executable files from running unless they meet a prevalence, age, or trusted list criterionBlock execution of potentially obfuscated scriptsBlock JavaScript or VBScript from launching downloaded executable contentBlock process creations originating from PSExec and WMI commands Log workstation PowerShell commands: Even without Microsoft Defender resources you need to…
-
WebDAV Remote Code Execution 0-Day Actively Exploited, PoC Released
A critical zero-day vulnerability in Microsoft’s Web Distributed Authoring and Versioning (WebDAV) protocol, tracked as CVE-2025-33053, has been actively exploited by the advanced persistent threat (APT) group Stealth Falcon since March 2025. The flaw, patched in June’s Patch Tuesday, enables remote code execution (RCE) via manipulated .url shortcut files and has been linked to attacks…
-
Assured Compliance Through Effective NHI Management
Is Assured Compliance Your Ultimate Goal? Consider Effective NHI Management Ever wondered how Non-Human Identities (NHIs) and Secrets Security Management could significantly enhance your cybersecurity strategy and lead to assured compliance? With the ever-increasing threats, it is essential for every organization, regardless of its sector, to prioritize robust strategies that can provide end-to-end protection. By……
-
Password Spraying Attacks Hit Entra ID Accounts
Hackers Use TeamFiltration Penetration Testing Tool. A threat actor is using the password spraying feature of the TeamFiltration pentesting tool to launch attacks against Microsoft Entra accounts – and finding success. The threat actor has targeted more than 80,000 user accounts across roughly 100 cloud tenants. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/password-spraying-attacks-hit-entra-id-accounts-a-28682
-
Securonix Buys ThreatQuotient for Integrated Threat Intel
ThreatQuotient Deal Brings Deeper Context to Alerts and Streamlines SOC Workflows. Securonix has acquired ThreatQuotient to modernize SOC platforms with external threat intelligence and agentic AI. The combined solution aims to help CISOs manage alert overload, boost detection precision and support global scale across regulated industries. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/securonix-buys-threatquotient-for-integrated-threat-intel-a-28681
-
Hacking the Hackers: When Bad Guys Let Their Guard Down
A string of threat-actor OpSec failures have yielded unexpected windfalls for security researchers and defenders. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/hacking-hackers-bad-guys-guard-down
-
Threat Actors Exploit DeepSeek-R1 Popularity to Target Windows Device Users
A new, highly sophisticated cyberattack campaign is targeting users seeking to download the popular language model DeepSeek-R1, exploiting global interest in large language models (LLMs). Kaspersky researchers have uncovered that threat actors are utilizing malvertising and phishing tactics to distribute previously unknown malware, named BrowserVenom, capable of hijacking victims’ web traffic and stealing sensitive information.…
-
WordPress Sites Turned Weapon: How VexTrio and Affiliates Run a Global Scam Network
The threat actors behind the VexTrio Viper Traffic Distribution Service (TDS) have been linked to other TDS services like Help TDS and Disposable TDS, indicating that the sophisticated cybercriminal operation is a sprawling enterprise of its own that’s designed to distribute malicious content.”VexTrio is a group of malicious adtech companies that distribute scams and harmful…
-
AitM Phishing Attacks on Microsoft 365 and Google Aimed at Stealing Login Credentials
A dramatic escalation in phishing attacks leveraging Adversary-in-the-Middle (AiTM) techniques has swept across organizations worldwide in early 2025, fueled by the rapid evolution and proliferation of Phishing-as-a-Service (PhaaS) platforms. Sekoia researchers and threat intelligence teams are sounding the alarm as these attacks become more complex, harder to detect, and increasingly effective at bypassing even advanced…
-
Threat Actors Using Bat Files to Deploy Quasar RAT
Remote Access Trojans (RATs)like Quasar have been a persistent threat for years, enabling attackers to control infected systems remotely. Recent SANS research has uncovered a new and particularly stealthy Quasar campaign, characterized by strong obfuscation and an innovative anti-sandbox technique. The infection begins with a batch (.bat) script attached to a seemingly harmless document. When…
-
New Cybersecurity Executive Order: What You Need To Know
Tags: ai, cisa, cloud, communications, compliance, computing, control, cyber, cybersecurity, data, defense, detection, encryption, exploit, fedramp, framework, government, identity, incident response, infrastructure, Internet, iot, network, office, privacy, programming, resilience, risk, service, software, supply-chain, technology, threat, update, vulnerability, vulnerability-management, zero-trustA new cybersecurity Executive Order aims to modernize federal cybersecurity with key provisions for post-quantum encryption, AI risk and secure software development. On June 6, 2025, the White House released a new Executive Order (EO) aimed at modernizing the nation’s cybersecurity posture. As cyber threats continue to evolve in scale and sophistication, the EO reinforces…
-
Linux Malware Authors Targeting Cloud Environments with ELF Binaries
Unit 42, Palo Alto Networks’ threat intelligence division, has recently conducted investigations that have revealed a worrying trend: threat actors are increasingly creating and modifying Linux Executable and Linkable Format (ELF) malware to attack cloud infrastructure. With cloud adoption skyrocketing and Linux-based systems underpinning the vast majority of cloud workloads estimates suggest between 70% and…
-
295 Malicious IPs Launch Coordinated Brute-Force Attacks on Apache Tomcat Manager
Threat intelligence firm GreyNoise has warned of a “coordinated brute-force activity” targeting Apache Tomcat Manager interfaces.The company said it observed a surge in brute-force and login attempts on June 5, 2025, an indication that they could be deliberate efforts to “identify and access exposed Tomcat services at scale.”To that end, 295 unique IP addresses have…
-
The critical role that partnerships play in shrinking the cyber skills gap
Building the cyber talent pipeline through partnerships: a real-world example: Fortinet’s work in Morocco offers an example of how uniquely crafted partnerships can help develop cyber-talent pipelines, particularly in under-resourced regions. Through the “Code 212” initiative, Fortinet works with two ministries and 12 Moroccan universities, integrating hands-on cybersecurity training for students across many disciplines. We…