Tag: threat
-
Coinbase Offers $20m Bounty to Take Down Cybercrime Ring Behind Hack
Coinbase is offering a $20m reward to help catch the threat actor behind a cyber-attack that could cost it between $180-$400m First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/coinbase-offers-20m-bounty/
-
Scattered Spider retail attacks spreading to US, says Google
Google’s threat intel analysts are aware of a number of in-progress cyber attacks against US retailers linked to the same Scattered Spider gang that supposedly attacked M&S and Co-op in the UK First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366623999/Scattered-Spider-retail-attacks-spreading-to-US-says-Google
-
Stealth RAT uses a PowerShell loader for fileless attacks
Threat actors have been spotted using a PowerShell-based shellcode loader to stealthily deploy Remcos RAT, a popular espionage-ready tool in line with a broader shift toward fileless techniques.As discovered by Qualys, the campaign executes a number of steps to phish an obfuscated .HTA (HTML Application) file that runs layered PowerShell scripts entirely in memory.”The attackers…
-
TransferLoader Malware Enables Attackers to Execute Arbitrary Commands on Infected Systems
A formidable new malware loader, dubbed TransferLoader, has emerged as a significant cybersecurity threat, as detailed in a recent report by Zscaler ThreatLabz. Active since at least February 2025, this sophisticated malware has been observed deploying multiple components, including a downloader, a backdoor, and a specialized loader for the backdoor module. These components collectively enable…
-
Critical Infrastructure Under Siege: OT Security Still Lags
With critical infrastructure facing constant cyber threats from the Typhoons and other corners, federal agencies and others are warning security for the OT network, a core technology in many critical sectors, is not powered up enough. First seen on darkreading.com Jump to article: www.darkreading.com/ics-ot-security/critical-infrastructure-ot-security-still-lags
-
5 BCDR Essentials for Effective Ransomware Defense
Ransomware has evolved into a deceptive, highly coordinated and dangerously sophisticated threat capable of crippling organizations of any size. Cybercriminals now exploit even legitimate IT tools to infiltrate networks and launch ransomware attacks. In a chilling example, Microsoft recently disclosed how threat actors misused its Quick Assist remote assistance tool to deploy the destructive First…
-
Russia-Linked APT28 Exploited MDaemon Zero-Day to Hack Government Webmail Servers
A Russia-linked threat actor has been attributed to a cyber espionage operation targeting webmail servers such as Roundcube, Horde, MDaemon, and Zimbra via cross-site scripting (XSS) vulnerabilities, including a then-zero-day in MDaemon, according to new findings from ESET.The activity, which commenced in 2023, has been codenamed Operation RoundPress by the Slovak cybersecurity company. It has…
-
Ransomware gangs join ongoing SAP NetWeaver attacks
Ransomware gangs have joined ongoing SAP NetWeaver attacks, exploiting a maximum-severity vulnerability that allows threat actors to gain remote code execution on vulnerable servers. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/ransomware-gangs-join-ongoing-sap-netweaver-attacks/
-
BianLian and RansomExx Exploit SAP NetWeaver Flaw to Deploy PipeMagic Trojan
At least two different cybercrime groups BianLian and RansomExx are said to have exploited a recently disclosed security flaw in SAP NetWeaver, indicating that multiple threat actors are taking advantage of the bug.Cybersecurity firm ReliaQuest, in a new update published today, said it uncovered evidence suggesting involvement from the BianLian data extortion crew and the…
-
Google says hackers behind UK retail cyber campaign now also targeting US
“US retailers should take note” of recent cyberattacks on British companies, according to Google’s Threat Intelligence Group, as the financially motivated collective known as Scattered Spider appears to be connected. First seen on therecord.media Jump to article: therecord.media/scattered-spider-suspected-retail-hackers-google-alert
-
How One Leaked Credential Can Expose a Threat Actor
The Power of One: From Leaked Credential to Campaign Attribution Attribution has always been the elusive prize in threat intelligence. The question every CISO wants answered after an attack: “Who did this?” Historically, attribution required heavy resources, deep visibility, and sometimes even luck. But in today’s world of digital risk intelligence, one leaked credential can……
-
Cyberattacks on Long Island Schools Highlight Growing Threat
In a concerning development, over 20 school districts across Long Island have fallen victim to cyberattacks, compromising the personal data of more than 10,000 students. According to state education records, 28 incidents were reported in 2024 alone, affecting districts such as Great Neck, Smithtown, Brentwood, and Hewlett-Woodmere. New York Post+1New York Post+1 The Nature of…
-
Threat Actors Leverage Weaponized HTML Files to Deliver Horabot Malware
A recent discovery by FortiGuard Labs has unveiled a cunning phishing campaign orchestrated by threat actors deploying Horabot malware, predominantly targeting Spanish-speaking users in Latin America. This high-severity threat, detailed in the 2025 Global Threat Landscape Report, exploits malicious HTML files embedded in phishing emails to steal sensitive information, including email credentials and banking data,…
-
TA406 Hackers Target Government Entities to Steal Login Credentials
Tags: attack, credentials, cyber, government, hacker, intelligence, login, malware, north-korea, phishing, russia, threat, ukraineThe North Korean state-sponsored threat actor TA406, also tracked as Opal Sleet and Konni, has set its sights on Ukrainian government entities. Proofpoint researchers have uncovered a dual-pronged offensive involving both credential harvesting and malware deployment through highly targeted phishing campaigns. The likely objective of these attacks is to gather strategic intelligence on the Russian…
-
Google Threat Intelligence Releases Actionable Threat Hunting Technique for Malicious .desktop Files
Google Threat Intelligence has unveiled a series of sophisticated threat hunting techniques to detect malicious .desktop files, a novel attack vector leveraged by threat actors to compromise systems. Initially documented by Zscaler researchers in 2023, this technique involves the abuse of .desktop files-plain text configuration files used to define application launch behavior in Linux desktop…
-
Was ist Threat-Intelligence
Threat-Intelligence ist die strukturierte Sammlung, Auswertung und Analyse von Informationen über aktuelle und potenzielle Cyberbedrohungen. Ziel ist es, Organisationen dabei zu unterstützen, sich proaktiv vor Angriffen zu schützen, Sicherheitsmaßnahmen gezielter einzusetzen, um schnell auf Vorfälle zu reagieren. Typen von Threat-Intelligence Typ Beschreibung Taktisch Informationen über Techniken, Taktiken und Prozeduren (TTPs) von Angreifern. Operativ…
-
Researchers Unveil New Mechanism to Track Compartmentalized Cyber Threats
Cisco Talos, in collaboration with The Vertex Project, has introduced an innovative approach to tackle the rising complexity of compartmentalized cyber threats. As modern cyberattacks increasingly involve multiple threat actors executing distinct stages of an attack kill chain-such as initial access, exploitation, and ransomware deployment-traditional threat modeling frameworks like the Diamond Model have struggled to…
-
New HTTPBot Botnet Rapidly Expands to Target Windows Machines
The HTTPBot Botnet, a novel Trojan developed in the Go programming language, has seen a sharp rise in activity since its first detection in August 2024. According to the latest findings from NSFOCUS Fuying Lab’s Global Threat Hunting system, HTTPBot has rapidly expanded its reach, particularly in April 2025, with over 200 attack instructions issued.…
-
Katz Stealer Malware Hits 78+ Chromium and Gecko-Based Browsers
Newly disclosed information-stealing malware dubbed Katz Stealer has emerged as a significant threat to users of Chromium and Gecko-based browsers, with capabilities to extract sensitive data from over 78 browser variants. Developed in C and Assembly (ASM) for lightweight efficiency, the malware targets credentials, cookies (including version 20+), autofill data, CVV2 codes, OAuth tokens, cryptocurrency…
-
Congress Should Tackle Cyber Threats, Not Competition
Some members of Congress seem more intent on grabbing headlines than actually working to make America more cyber secure. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/congress-cyber-threats-competition
-
CTM360 Identifies Surge in Phishing Attacks Targeting Meta Business Users
A new global phishing threat called “Meta Mirage” has been uncovered, targeting businesses using Meta’s Business Suite. This campaign specifically aims at hijacking high-value accounts, including those managing advertising and official brand pages.Cybersecurity researchers at CTM360 revealed that attackers behind Meta Mirage impersonate official Meta communications, tricking users into handing First seen on thehackernews.com Jump…
-
New security paradigm needed for IT/OT convergence
Industry leaders and policymakers highlight growing cyber threats from the integration of IT and operational technology systems, calling for collaboration and regulatory frameworks to protect critical systems, among other measures First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366623862/New-security-paradigm-needed-for-IT-OT-convergence
-
Healthcare Cyberattacks in 2024 Expose 276 Million Patient Records Compromised
The healthcare sector faced an unprecedented wave of cyber threats, with a staggering 92% of organizations reporting at least one cyberattack. This alarming statistic resulted in the compromise of over 276 million patient records, equating to approximately 758,000 records breached daily. The fallout from these breaches has been profound, with victims of medical identity theft…
-
Threat Actors Exploit AI and LLM Tools for Offensive Cyber Operations
A recent report from the S2W Threat Intelligence Center, TALON, sheds light on the escalating misuse of generative AI and large language models (LLMs) by threat actors on the dark web for malicious cyber operations. As LLMs like ChatGPT, Claude, and DeepSeek grow in capability, they are increasingly weaponized as offensive tools for exploit generation,…
-
Nation-State Actors Target Healthcare Institutions to Sabotage IT and OT Systems
The nation-state actors have increasingly set their sights on healthcare institutions worldwide, launching sophisticated cyberattacks aimed at disrupting both Information Technology (IT) and Operational Technology (OT) systems. These attacks, often orchestrated by state-sponsored groups with significant resources, pose a severe threat to patient safety, data integrity, and the operational continuity of critical healthcare services. Cybersecurity…
-
Strengthening Cloud Security: API Posture Governance, Threat Detection, and Attack Chain Visibility with Salt Security and Wiz
Tags: api, attack, authentication, best-practice, cloud, compliance, data, detection, exploit, google, governance, incident response, malicious, risk, risk-assessment, threat, tool, vulnerabilityIntroduction In the current cloud-centric environment, strong API security is essential. Google’s acquisition of Wiz underscores the urgent necessity for all-encompassing cloud security solutions. Organizations should focus on both governing API posture, ensuring secure configuration and deployment to reduce vulnerabilities and assure compliance, and on effective threat detection and response. Salt Security’s API Protection Platform…
-
Go ahead and ignore Patch Tuesday it might improve your security
No rush, according to Gartner chap who says: ‘Nobody has ever out-patched threat actors at scale’ First seen on theregister.com Jump to article: www.theregister.com/2025/05/14/improve_patching_strategies/
-
Chinese Hackers Exploit SAP NetWeaver Zero-Day Vulnerability to Target Critical Infrastructure
Tags: china, cve, cyber, espionage, exploit, flaw, hacker, infrastructure, remote-code-execution, sap, threat, vulnerability, zero-dayEclecticIQ analysts have uncovered a sophisticated cyber-espionage campaign orchestrated by China-nexus nation-state Advanced Persistent Threats (APTs) targeting critical infrastructure worldwide. In April 2025, these threat actors launched a high-tempo exploitation campaign against SAP NetWeaver Visual Composer, exploiting a zero-day vulnerability identified as CVE-2025-31324. This unauthenticated file upload flaw allows remote code execution (RCE), providing attackers…
-
Researchers Unveil New Threat-Hunting Techniques to Detect Azure Managed Identity Abuse
A group of cybersecurity specialists from Hunters, working under the prestigious Team Axon, have presented sophisticated threat-hunting techniques in a ground-breaking research paper titled >>Mastering Azure Managed Identities: Attack & Defense, Part 2,