Tag: threat
-
Interlock Ransomware Uses NodeSnake RAT for Persistent Access to Corporate Networks
In a two UK-based universities have fallen victim to a sophisticated Remote Access Trojan (RAT) dubbed NodeSnake within the past two months. According to analysis by Quorum Cyber’s Threat Intelligence (QCTI) team Report, this malware, likely deployed by the ransomware group Interlock, showcases advanced capabilities for persistent access and network infiltration. Emerging Threat Targets Higher…
-
Getting Ahead of AI Risk: What Comes Next for Tenable
The acquisition of Apex Security adds a powerful new layer of visibility, context and control to the Tenable One Exposure Management Platform to govern usage, enforce policy and control exposure across both the AI that organizations use and the AI they build. Over the past 25 years, we’ve seen the attack surface shift dramatically, from…
-
Thousands of ASUS routers compromised in sophisticated hacking campaign
Researchers have previously linked the suspected threat actor, dubbed ViciousTrap, to the exploitation of Cisco routers. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/thousands-asus-routers-compromised-hacking/749259/
-
Victoria’s Secret ‘s website offline following a cyberattack
Victoria’s Secret took its website offline after a cyberattack, with experts warning of rising threats against major retailers. American lingerie, clothing, and beauty retailer Victoria’s Secret took its website offline following a cyberattack. At this time, the site shows the following message: >>Valued customer, we identified and are taking steps to address a security incident.…
-
Check Point Enhances Enterprise Security with AI-Driven Threat Management
Check Point Software has announced the launch of its next generation Quantum Smart-1 Management Appliances. These appliances deliver 2X increase in managed gateways and up to 70% higher log rate, with AI-powered security tools designed to meet the demands of hybrid enterprises. Fully integrated within the Check Point Infinity Platform, they offer faster, more intelligent…
-
Threat actors abuse Google Apps Script in evasive phishing attacks
Threat actors are abusing the trusted Google platform ‘Google Apps Script’ to host phishing pages, making them appear legitimate and eliminating the risk of them getting flagged by security tools. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/threat-actors-abuse-google-apps-script-in-evasive-phishing-attacks/
-
Apple Safari exposes users to fullscreen browserthe-middle attacks
A weakness in Apple’s Safari web browser allows threat actors to leverage the fullscreen browser-in-the-middle (BitM) technique to steal account credentials from unsuspecting users. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/apple-safari-exposes-users-to-fullscreen-browser-in-the-middle-attacks/
-
Cybercriminals Target AI Users with Malware-Loaded Installers Posing as Popular Tools
Tags: ai, chatgpt, cisco, cybercrime, intelligence, malware, openai, powershell, ransomware, threat, toolFake installers for popular artificial intelligence (AI) tools like OpenAI ChatGPT and InVideo AI are being used as lures to propagate various threats, such as the CyberLock and Lucky_Gh0$t ransomware families, and a new malware dubbed Numero.”CyberLock ransomware, developed using PowerShell, primarily focuses on encrypting specific files on the victim’s system,” Cisco Talos researcher Chetan…
-
Check Point Launches Next-Gen Branch Office Security, Boosting Threat Prevention Speed by 4x
Check Point has announced significant advancements to its Quantum Force Security Gateways family. As a result, all Quantum Force Security Gateways for data centres and perimeters are set to receive a 15-25% performance uplift in threat prevention throughput, delivered automatically via a software update. In parallel, Check Point is rolling out a new line-up of…
-
China-backed hackers hiding malware in calendar events
The APT41 nation-state threat group is exploiting yet another cloud service to mask its operations, according to new research. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/china-hackers-google-calendar-events-research/749290/
-
19 Billion Passwords Leaked: Protect Yourself from Cyber Threats
Discover the implications of the 19 billion passwords leaked in the RockYou2024 breach. Learn essential actions to secure your accounts now! First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/05/19-billion-passwords-leaked-protect-yourself-from-cyber-threats/
-
Cybercriminals exploit AI hype to spread ransomware, malware
Threat actors linked to lesser-known ransomware and malware projects now use AI tools as lures to infect unsuspecting victims with malicious payloads. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cybercriminals-exploit-ai-hype-to-spread-ransomware-malware/
-
Criminal IP Set to Make Its Debut at Infosecurity Europe 2025
Criminal IP, the AI-powered threat intelligence platform developed by AI SPERA (led by CEO Byungtak Kang), has announced its first participation in Infosecurity Europe 2025, the largest cybersecurity conference in Europe. The event will take place from June 3 to 5, 2025, at ExCeL London, where Criminal IP will engage with global security professionals at…
-
China-linked hackers exploit Google Calendar in cyberattacks on governments
Tags: china, cyber, cyberattack, espionage, exploit, google, government, hacker, intelligence, threatGoogle Threat Intelligence spotted the China-based operation known as APT41 leveraging the company’s own Calendar app as part of a cyber-espionage campaign. First seen on therecord.media Jump to article: therecord.media/china-linked-apt41-exploits-google-calendar-in-cyberattacks
-
New PumaBot Hijacks IoT Devices via SSH Brute-Force for Persistent Access
Tags: access, botnet, cyber, cybersecurity, data-breach, exploit, Internet, iot, malicious, malware, software, threat, vulnerabilityA sophisticated new malware, dubbed PumaBot, has emerged as a significant threat to Internet of Things (IoT) devices worldwide. Cybersecurity researchers have identified this malicious software as a highly advanced botnet that exploits weak security configurations in IoT ecosystems, particularly targeting devices with exposed SSH (Secure Shell) ports. Emerging Threat Targets Vulnerable IoT Ecosystems By…
-
Microsoft Entra’s billing roles pose privilege escalation risks in Azure
Potential abuse for persistence, elevated access: Essentially, guest users assigned specific billing roles, such as “Billing Account Contributor”, can create new Azure subscriptions within a host tenant. This action does not require explicit permissions in the target tenant, effectively allowing guests to establish a foothold without direct administrative oversight.Once a subscription is created, the guest…
-
How Red Canary Acquisition Will Fortify Zscaler’s MDR Muscle
Zscaler Aims for SOC Leadership With Enhanced Visibility Across Endpoints and Cloud. By acquiring Denver-based startup Red Canary, cloud security stalwart Zscaler adds deep MDR functionality and aims to unify detection workflows across its customer environments using insights from its massive transaction volume, identity analytics and Red Canary’s advanced threat-hunting service. First seen on govinfosecurity.com…
-
Thousands of ASUS Routers Hijacked in Stealthy Backdoor Campaign
A threat actor has used ASUS routers’ legitimate features to create persistent backdoors that survive firmware updates and reboots First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/thousands-asus-routers-compromised/
-
An Enterprise Playbook to Defending Against Volt Typhoon
An identity threat detection approach built on access intelligence is key to identifying and disrupting campaigns like Volt Typhoon. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/05/an-enterprise-playbook-to-defending-against-volt-typhoon/
-
CISA Releases Dedicated SIEM SOAR Guide for Cybersecurity Professionals
Security Information and Event Management (SIEM) platforms are essential for detecting, analyzing, and responding to cybersecurity threats in real time. However, the effectiveness of a SIEM system depends heavily on the quality and prioritization of logs ingested. This article explores best practices for SIEM log ingestion, technical considerations, and provides a reference table of high-priority…
-
DragonForce Exploits SimpleHelp Flaws to Deploy Ransomware Across Customer Endpoints
The threat actors behind the DragonForce ransomware gained access to an unnamed Managed Service Provider’s (MSP) SimpleHelp remote monitoring and management (RMM) tool, and then leveraged it to exfiltrate data and drop the locker on multiple endpoints.It’s believed that the attackers exploited a trio of security flaws in SimpleHelp (CVE-2024-57727, CVE-2024-57728, and CVE-2024-57726) that were…
-
Cybercriminals camouflaging threats as AI tool installers
Cisco Talos has uncovered new threats, including ransomware like CyberLock and Lucky_Gh0$t, and a destructive malware called Numero, all disguised as legitimate AI tool installers to target victims. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/fake-ai-tool-installers/
-
New ChoiceJacking Exploit Targets Android and iOS via Infected Charging Ports
A team of cybersecurity researchers from the Institute of Information Security and A-SIT Secure Information Technology Centre Austria has unveiled a new class of USB-based attacks on mobile devices, dubbed “ChoiceJacking.” This attack revives and surpasses the notorious “juice jacking” threat from a decade ago, which prompted Apple and Google to introduce user confirmation prompts…
-
Malicious WordPress Plugin Disguised as Java Update Infects Site Visitors
A troubling new cyber threat has emerged targeting WordPress websites, where a malicious plugin masquerading as a legitimate tool tricks visitors into downloading harmful software. Disguised as “Yoast SEO” with convincing metadata, this plugin was recently uncovered in the /wp-content/plugins/contact-form/ directory of an infected site. Rather than providing SEO functionality, it injects a deceptive JavaScript…
-
APT Hackers Turn Google Calendar Into Command Hub Using TOUGHPROGRESS Malware, Google Alerts
Google Threat Intelligence Group (GTIG), a sophisticated malware campaign dubbed >>TOUGHPROGRESS
-
Chinese APT41 Exploits Google Calendar for Malware CommandControl Operations
Google on Wednesday disclosed that the Chinese state-sponsored threat actor known as APT41 leveraged a malware called TOUGHPROGRESS that uses Google Calendar for command-and-control (C2).The tech giant, which discovered the activity in late October 2024, said the malware was hosted on a compromised government website and was used to target multiple other government entities.”Misuse of…
-
How to threat hunt Living Off The Land binaries
In this Help Net Security video, Lee Archinal, Senior Threat Hunter at Intel 471, walks through practical strategies for detecting malicious activity involving Living Off The … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/05/29/threat-hunt-living-off-the-land-binaries-video/
-
New Cyber Threat: UTG015 Exploits 0-Days for Espionage in Asia
In a threat intelligence report, the Qi’anxin Threat Intelligence Center has exposed a series of highly targeted attacks First seen on securityonline.info Jump to article: securityonline.info/new-cyber-threat-utg-q-015-exploits-0-days-for-espionage-in-asia/