Tag: threat
-
Cyberattack on ConnectWise believed to be nation-state threat actor
First seen on scworld.com Jump to article: www.scworld.com/news/cyberattack-on-connectwise-believed-to-be-nation-state-threat-actor
-
‘Earth Lamia’ Exploits Known SQL, RCE Bugs Across Asia
A highly active Chinese threat group is taking proverbial candy from babies, exploiting known bugs in exposed servers to steal data from organizations in sensitive sectors. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/earth-lamia-exploits-sql-rce-bugs-asia
-
US intelligence employee arrested for alleged double-dealing of classified info
The 28-year-old, who’d been employed by the Defense Intelligence Agency since 2019, specialized in insider threats and had top secret security clearance, officials said. First seen on cyberscoop.com Jump to article: cyberscoop.com/dia-employee-arrested-nathan-vilas-laatsch/
-
Preview: Hot Sessions at Infosecurity Europe 2025 in London
Ransomware, Quantum Computing, Geopolitics, GenAI and More on the Agenda Infosecurity Europe is set to return June 3 to London. Hot topics at this year’s event include everything from quantum computing, geopolitics and artificial intelligence, to supply chain attacks, insider threats and the cybercrime juggernaut that continues to be ransomware. First seen on govinfosecurity.com Jump…
-
Why AI Hallucinations Are the Biggest Threat to Gen AI’s Adoption in Enterprises
In 2024, enterprise investments in generative AI skyrocketed. Microsoft alone committed over $10 billion to OpenAI, and according to a Gartner report, more than 80%…Read More First seen on securityboulevard.com Jump to article: https://securityboulevard.com/2025/05/why-ai-hallucinations-are-the-biggest-threat-to-gen-ais-adoption-in-enterprises/
-
Beware: Weaponized AI Tool Installers Infect Devices with Ransomware
Cisco Talos has uncovered a series of malicious threats masquerading as legitimate AI tool installers, targeting unsuspecting users and businesses across multiple industries. These threats, including the CyberLock and Lucky_Gh0$t ransomware families, along with a newly identified destructive malware dubbed “Numero,” exploit the growing popularity of AI solutions in sectors like B2B sales, technology, and…
-
ConnectWise warns of threat activity linked to suspected nation-state hackers
The company said suspicious activity has affected a limited number of ScreenConnect customers. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/connectwise-warns-threat-nation-state/749422/
-
Threat Actors Exploit Google Apps Script to Host Phishing Sites
The Cofense Phishing Defense Center has uncovered a highly strategic phishing campaign that leverages Google Apps Script a legitimate development platform within Google’s ecosystem to host deceptive phishing pages. This attack, masquerading as an invoice email, exploits the inherent trust users place in Google’s trusted environment to trick recipients into divulging sensitive information. A Sophisticated…
-
Dadsec Hacker Group Uses Tycoon2FA Infrastructure to Steal Office365 Credentials
Tags: credentials, cyber, cybersecurity, group, hacker, infrastructure, intelligence, microsoft, phishing, service, threatCybersecurity researchers from Trustwave’s Threat Intelligence Team have uncovered a large-scale phishing campaign orchestrated by the notorious hacker group Storm-1575, also known as >>Dadsec.
-
Microsoft Reveals Techniques for Defending Against Evolving AiTM Attacks
Tags: attack, authentication, cloud, credentials, cyber, data-breach, email, microsoft, phishing, threatMicrosoft has exposed the escalating sophistication of phishing attacks, particularly focusing on Adversary-in-the-Middle (AiTM) techniques that are becoming a cornerstone of modern cyber threats. As organizations increasingly adopt multifactor authentication (MFA), passwordless solutions, and robust email protections, threat actors are adapting with advanced methods to steal credentials, especially targeting enterprise cloud environments. AiTM attacks, often…
-
Pure Crypter Uses Multiple Evasion Methods to Bypass Windows 11 24H2 Security Features
Pure Crypter, a well-known malware-as-a-service (MaaS) loader, has been recognized as a crucial tool for threat actors targeting Windows-based systems in a thorough technical research carried out by eSentire’s Threat Response Unit (TRU) during 2024 and 2025. This loader, favored for deploying information stealers like Lumma and Rhadamanthys via the ClickFix initial access vector, has…
-
Threat Actor Claims TikTok Breach, Puts 428 Million Records Up for Sale
Alleged TikTok Breach: Threat actor “Often9” claims to sell 428M user records, including emails, phones, and account details on dark web forum. First seen on hackread.com Jump to article: hackread.com/threat-actor-tiktok-breach-428-million-records-sale/
-
Tenable to Acquire AI Security Startup Apex
Apex will enhance Tenable’s AI Aware tool by mitigating the threats of AI applications and tools not governed by organizations, while enforcing existing security policies. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/tenable-acquire-ai-security-apex
-
China-Linked Hackers Exploit SAP and SQL Server Flaws in Attacks Across Asia and Brazil
The China-linked threat actor behind the recent in-the-wild exploitation of a critical security flaw in SAP NetWeaver has been attributed to a broader set of attacks targeting organizations in Brazil, India, and Southeast Asia since 2023.”The threat actor mainly targets the SQL injection vulnerabilities discovered on web applications to access the SQL servers of targeted…
-
Hackers Use AI-Generated Videos on TikTok to Spread Info-Stealing Malware
TrendMicro has uncovered a sophisticated campaign where threat actors are exploiting TikTok to distribute information-stealing malware. By leveraging AI-generated videos posing as tutorials for unlocking pirated software, cybercriminals trick unsuspecting viewers into executing malicious PowerShell commands. These commands download dangerous malware strains such as Vidar and StealC, designed to harvest sensitive data from infected systems.…
-
Void Blizzard nimmt NATO-Organisationen ins Visier
Tags: access, api, authentication, blizzard, cloud, cyberattack, cyberespionage, edr, fido, framework, governance, government, hacker, intelligence, mail, malware, mfa, microsoft, open-source, passkey, password, phishing, risk, siem, spear-phishing, threat, tool, ukraineRussische Hacker ändern ihre Taktik von Passwort-Spraying zu Phishing, aber ihre Ziele innerhalb der NATO bleiben gleich.Seit über einem Jahr hat es eine neue Cyberspionage-Gruppe, die mit der russischen Regierung in Verbindung stehen soll, auf Unternehmen aus verschiedenen Branchen innerhalb der NATO abgesehen. Die Gruppe wird von Microsoft Threat Intelligence ‘Void Blizzard” genannt. Die niederländischen…
-
Weaponized PyPI Package Executes Supply Chain Attack to Steal Solana Private Keys
A chilling discovery by Socket’s Threat Research Team has exposed a meticulously crafted supply chain attack on the Python Package Index (PyPI), orchestrated by a threat actor using the alias >>cappership.
-
Hackerangriff auf Außenministerium alarmiert Nato und EU
Die EU macht chinesische Hacker für eine bösartige Cyberkampagne gegen das Außenministerium in Tschechien verantwortlich.Ein mutmaßlicher chinesischer Hackerangriff gegen das Außenministerium in Tschechien alarmiert die Nato und die EU. In einer gemeinsamen Erklärung der 32 Nato-Staaten heißt es, man beobachte mit wachsender Besorgnis die zunehmenden böswilligen Cyberaktivitäten, die von der Volksrepublik China ausgehen und sei…
-
ConnectWise Hit by Cyberattack; Nation-State Actor Suspected in Targeted Breach
ConnectWise, the developer of remote access and support software ScreenConnect, has disclosed that it was the victim of a cyber attack that it said was likely perpetrated by a nation-state threat actor.”ConnectWise recently learned of suspicious activity within our environment that we believe was tied to a sophisticated nation-state actor, which affected a very small…
-
Meta Disrupts Influence Ops Targeting Romania, Azerbaijan, and Taiwan with Fake Personas
Meta on Thursday revealed that it disrupted three covert influence operations originating from Iran, China, and Romania during the first quarter of 2025.”We detected and removed these campaigns before they were able to build authentic audiences on our apps,” the social media giant said in its quarterly Adversarial Threat Report.This included a network of 658…
-
Warning: Threat actors now abusing Google Apps Script in phishing attacks
script[.]google[.]com. The attacker is betting the user will see and trust the Google brand, and therefore trust the content.”By using a trusted platform to host the phishing page, the threat actor creates a false sense of security, obscuring the underlying threat with the goal of getting the recipient to enter their email and password without…
-
APT41 Uses Google Calendar as Covert C2 in Stealthy Cyberespionage Campaign
In an example of cloud service abuse, Google Threat Intelligence Group (GTIG) has uncovered a new APT41 campaign First seen on securityonline.info Jump to article: securityonline.info/apt41-uses-google-calendar-as-covert-c2-in-stealthy-cyberespionage-campaign/
-
Why Zscaler’s Acquisition of Red Canary Matters to Your Cybersecurity Strategy
One of the most talked-about developments in cybersecurity this month is Zscaler’s acquisition of Red Canary, a move that highlights a larger industry trend: the growing demand for unified, automated security platforms that accelerate threat detection and response. But what does this really mean for security teams looking to stay ahead of ransomware, advanced threats,…
-
Webinar | How to Build a Platform-Based Defense Against Evolving Cyber Threats
Palo Alto Networks on How to Construct a Defense for Modern Threats. The rapid evolution of cyber threats, amplified by the integration of AI into adversarial tactics, calls for a shift in defensive strategies. Traditional approaches are no longer sufficient to address the sophistication, scale, and speed of modern attacks. First seen on govinfosecurity.com Jump…
-
APT41 Uses Google Calendar Events for C2
APT41, a Chinese state-sponsored threat actor also known as Double Dragon, used Google Calendar as command-and-control infrastructure during a campaign last fall. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/apt41-uses-google-calendar-events-c2
-
Victoria’s Secret Hit By ‘Security Incident’ After Attacks on UK Retailers
Victoria’s Secret took down its U.S. website this week after an unspecified security incident that cybersecurity experts believe is related to similar attacks on UK retailers earlier this month by the high-profile threat group Scattered Spider, which appears to be deploying the DragonForce ransomware in the campaign. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/05/victorias-secret-hit-by-security-incident-after-attacks-on-uk-retailers/
-
Tenable to Acquire Apex Security, Expanding Exposure Management for AI-Driven Threats
First seen on scworld.com Jump to article: www.scworld.com/news/tenable-to-acquire-apex-security-expanding-exposure-management-for-ai-driven-threats
-
A new author has appeared
Talos Content Manager Amy introduces themself, shares her unconventional journey into cybersecurity and reports on threats masquerading as AI installers. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/a-new-author-has-appeared/
-
Threat Actors Exploit Nifty[.]com Infrastructure in Sophisticated Phishing Attack
Threat actors have orchestrated a multi-wave phishing campaign between April and May 2025, leveraging the legitimate infrastructure of Nifty[.]com, a prominent Japanese Internet Service Provider (ISP), to execute their attacks. Uncovered by Raven, a leading threat detection entity, this operation stands out due to its ability to evade conventional email security systems by abusing trusted…
-
PureHVNC RAT Uses Fake Job Offers and PowerShell to Evade Security Defenses
A new and highly evasive malware campaign delivering the PureHVNC Remote Access Trojan (RAT) has been identified by Netskope Threat Labs, showcasing a complex multi-layer infection chain designed to bypass modern security defenses. This campaign, active in 2024, leverages fake job offers from well-known global brands like Bershka, Fragrance Du Bois, John Hardy, and Dear…