Tag: threat
-
New Crocodilus Malware Grants Full Control Over Android Devices
The Mobile Threat Intelligence (MTI) team identified a formidable new player in the mobile malware landscape: Crocodilus, an Android banking Trojan designed for device takeover. Initially observed in test campaigns with limited live instances, this malware has rapidly evolved, demonstrating a surge in active campaigns and sophisticated development. A Rising Threat in the Android Ecosystem…
-
Cybersecurity’s ‘rare earth’ skills: Scarce, high-value, and critical for future defense
Tags: ai, attack, business, ciso, computing, crypto, cryptography, cyber, cybersecurity, data, defense, detection, intelligence, jobs, programming, risk, skills, strategy, supply-chain, technology, threat, trainingAdvanced threat hunting expertise Like the rarest elements, professionals who can proactively identify novel threats and adversary techniques before they cause damage are scarce and extremely valuable. Why are these skills rare? Many factors have led to this scenario:Complex skill requirements: Effective threat hunters need a unique combination of skills, including deep cyber knowledge, programming…
-
Threat Actor Bribes Overseas Support Agents to Steal Coinbase Customer Data
On May 15, 2025, Coinbase, the largest U.S. cryptocurrency exchange, publicly disclosed a major security breach that exposed the sensitive personal data of 69,461 users”, less than 1% of its monthly transacting base, but a significant figure given the depth of information compromised. This incident was not a typical crypto hack exploiting blockchain vulnerabilities; instead,…
-
6 ways CISOs can leverage data and AI to better secure the enterprise
Tags: advisory, ai, antivirus, attack, automation, breach, business, ciso, cloud, compliance, computer, corporate, cyber, cyberattack, cybersecurity, data, detection, firewall, framework, governance, guide, infrastructure, LLM, login, ml, network, programming, risk, risk-analysis, service, siem, soc, software, technology, threat, tool, trainingEmphasize the ‘learning’ part of ML: To be truly effective, models need to be retrained with new data to keep up with changing threat vectors and shifting cyber criminal behavior.”Machine learning models get smarter with your help,” Riboldi says. “Make sure to have feedback loops. Letting analysts label events and adjust settings constantly improves their…
-
Cartier disclosed a data breach following a cyber attack
Luxury-goods conglomerate Cartier disclosed a data breach that exposed customer information after a cyberattack. Cartier has disclosed a data breach following a cyberattack that compromised its systems, exposing customers’ personal information. The incident comes amid a wave of cyberattacks targeting luxury fashion brands. The luxury firm states that the threat actors gained access to >>limited…
-
Microsoft Defender for Endpoint Prevents Cyberattack,Secures 180,000 Devices
The modern digital estate is under siege. Over the past 18 months, Microsoft’s threat protection teams have tracked a staggering 275% increase in ransomware encounters, with attackers shifting from broad, random attacks to highly targeted, multi-domain campaigns that exploit unique vulnerabilities in each organization. These attacks are not only more frequent but also faster”, thousands…
-
Stay Ahead of Identity Threats with Grip ITDR 2.0 – Grip
Prevent, detect, and respond to identity threats across all SaaS with Grip’s ITDR 2.0 product. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/06/stay-ahead-of-identity-threats-with-grip-itdr-2-0-grip/
-
Phone chipmaker Qualcomm fixes three zero-days exploited by hackers
Google’s Threat Analysis Group, which investigates government-backed hacks, was credited with the discovery of the zero-days. First seen on techcrunch.com Jump to article: techcrunch.com/2025/06/03/phone-chipmaker-qualcomm-fixes-three-zero-days-exploited-by-hackers/
-
Security Compass Adds Devici to Strengthen Threat Modeling in Secure Software Design
First seen on scworld.com Jump to article: www.scworld.com/news/security-compass-adds-devici-to-strengthen-threat-modeling-in-secure-software-design
-
ZEST Security and Upwind Partner to Close the Gap Between Cloud Threat Detection and Action
First seen on scworld.com Jump to article: www.scworld.com/news/zest-security-and-upwind-partner-to-close-the-gap-between-cloud-threat-detection-and-action
-
Microsoft, CrowdStrike look to harmonize threat actor terminology
First seen on scworld.com Jump to article: www.scworld.com/news/microsoft-crowdstrike-pitch-giving-threat-groups-the-same-name
-
ConnectWise ScreenConnect Vulnerability Exploited: CISA
CISA warned that the ConnectWise ScreenConnect vulnerability is being exploited by threat actors to perform ViewState code injection attacks. First seen on crn.com Jump to article: www.crn.com/news/security/2025/connectwise-screenconnect-vulnerability-exploited-cisa
-
Coinbase breach tied to bribed TaskUs support agents in India
A recently disclosed data breach at Coinbase has been linked to India-based customer support representatives from outsourcing firm TaskUs, who threat actors bribed to steal data from the crypto exchange. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/coinbase-breach-tied-to-bribed-taskus-support-agents-in-india/
-
CrowdStrike, Microsoft aim to eliminate confusion in threat group attribution
Wild variances in naming taxonomies aren’t going away, but a new initiative from the security vendors aims to more publicly address obvious overlap in threat group attribution. First seen on cyberscoop.com Jump to article: cyberscoop.com/crowdstrike-microsoft-threat-group-attribution-initiative/
-
Microsoft, CrowdStrike Partner to Bring Clarity to Threat Actor Identities
Microsoft and CrowdStrike are partnering to bring better clarity to the information about threat groups, including their names and other attributes. They are creating ways for vendors to share and display such information so that they and businesses understand their adversaries and can more quickly respond to them. First seen on securityboulevard.com Jump to article:…
-
What Tackling the SaaS Security Problem Means to Me
By Kevin Hanes, CEO of Reveal Security When I reflect on the years I spent leading one of the world’s largest Security Operations Centers (SOCs) and incident response teams, the lessons learned aren’t just war stories”¦they’re a playbook for how we should rethink our responsibilities in the face of today’s fast-evolving attack surfaces. Back then,…
-
ASUS Router Hijackings Highlight Urgent Need for Advanced Threat Detection and Response
Introduction: A Breach Beyond the EndpointA new campaign targeting ASUS routers has compromised more than 9,000 devices worldwide, exposing a hidden weakness in many organizations’ security strategies: insufficient visibility and control at the edge. The attack, dubbed ViciousTrap, exploits CVE-2023-39780″, a command injection vulnerability”, to deploy malware that persists even after reboots and firmware updates.…
-
Man pleads guilty to swatting spree impacting scores of government officials
A man pleaded guilty to his involvement in a string of swatting and bomb threat incidents that allegedly impacted at least 25 members of Congress or their family members, as well as law enforcement officials and members of the federal judiciary. First seen on therecord.media Jump to article: therecord.media/man-pleads-guilty-swatting-spree-government-officials
-
New Linux PumaBot Targets IoT Devices with SSH Credential Brute-Force Attack
A new and insidious threat has surfaced in the cybersecurity landscape as Darktrace’s Threat Research team uncovers PumaBot, a Go-based Linux botnet meticulously designed to exploit embedded Internet of Things (IoT) devices. Unlike conventional botnets that cast a wide net through indiscriminate internet scans, PumaBot employs a highly targeted strategy, fetching a curated list of…
-
Russian Hacker Black Owl Targets Critical Industries to Steal Financial Data
A pro-Ukrainian hacktivist group known as BO Team, also operating under aliases such as Black Owl, Lifting Zmiy, and Hoody Hyena, has emerged as a formidable threat to Russian organizations in 2025. This group, which publicly declared its intentions via a Telegram channel in early 2024, has been implicated in a series of devastating cyberattacks…
-
Fake DocuSign, Gitcode Sites Spread NetSupport RAT via Multi-Stage PowerShell Attack
Threat hunters are alerting to a new campaign that employs deceptive websites to trick unsuspecting users into executing malicious PowerShell scripts on their machines and infect them with the NetSupport RAT malware.The DomainTools Investigations (DTI) team said it identified “malicious multi-stage downloader Powershell scripts” hosted on lure websites that masquerade as Gitcode and DocuSign.” First…
-
Interlock and the Kettering Ransomware Attack: ClickFix’s Persistence
Tags: access, attack, breach, captcha, ciso, computer, control, credentials, cyberattack, data, data-breach, detection, endpoint, exploit, group, healthcare, HIPAA, incident response, injection, malicious, mobile, network, phishing, powershell, ransom, ransomware, risk, saas, service, technology, threat, tool, vulnerabilityIn healthcare, every minute of downtime isn’t just a technical problem”Š”, “Šit’s a patient safety risk. CNN recently reported that Kettering Health, a major hospital network in Ohio, was hit by a ransomware attack. According to CNN, the Interlock ransomware group claimed responsibility, sending a chilling reminder that healthcare remains a prime target for this particular…
-
Zscaler Seeking To Boost Partner Services With Red Canary Deal: CEO
Zscaler is seeking to build a comprehensive security operations and threat management service through its planned acquisition of MDR provider Red Canary that will lead to major growth opportunities for partners, Zscaler CEO Jay Chaudhry told top partners Monday. First seen on crn.com Jump to article: www.crn.com/news/security/2025/zscaler-seeking-to-boost-partner-services-with-red-canary-deal-ceo
-
Steuer-Phishing zur Abgabefrist
Cyberkriminelle nutzen saisonale Ereignisse gerne aus die Steuersaison bildet da keine Ausnahme. Sie nutzen den erhöhten Stress, die knappen Fristen und die sensiblen Finanzdaten, um sich Zugang zu sensiblen Daten zu verschaffen. Angesichts der bevorstehenden Fristen in den USA und der EU beobachtete das Team von Threat Labs im März 2025 einen Anstieg der […]…
-
Scattered Spider: Three things the news doesn’t tell you
Scattered Spider isn’t one group, it’s an identity-first threat model evolving fast. From vishing to AiTM phishing, they’re exploiting MFA gaps to hijack the cloud. Watch the Push Security webinar to learn how their identity-based tactics work, and how to stop them. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/scattered-spider-three-things-the-news-doesnt-tell-you/
-
State-Sponsored Groups Intensify Attacks on Manufacturing Sector and OT Systems
The manufacturing sector has emerged as a prime target for cyber attackers in 2024, with a staggering 71% surge in active threat actors compared to the previous year, according to a recent report by Forescout Technologies. Between 2024 and the first quarter of 2025, 29 threat actors were actively targeting this critical infrastructure sector, with…
-
Qualys entdeckt zwei lokale Sicherheitslücken in Apport und Systemd-Coredump in Linux-Systemen
Die Qualys Threat Research Unit (TRU) hat zwei lokale Sicherheitslücken in Apport und Systemd-Coredump entdeckt, die die Offenlegung von Informationen ermöglichen. Bei beiden Problemen handelt es sich um Race-Condition-Schwachstellen. Die erste (CVE-2025-5054) betrifft den Core-Dump-Handler von Ubuntu, Apport, und die zweite (CVE-2025-4598) zielt auf Systemd-Coredump ab, den Standard-Core-Dump-Handler unter Red-Hat-Enterprise-Linux 9 und der kürzlich veröffentlichten…