Tag: threat
-
OctLurk and SilkLurk Backdoors Target Central Asian Governments in Cyberespionage Campaign
OctLurk and SilkLurk are highly customized, memory”‘resident backdoors used in an ongoing cyberespionage campaign against government and critical”‘sector networks across Central Asia and Syria, operated by a Chinese”‘speaking threat actor but not yet linked to a known APT. Active since January 2025, the operation leverages victim”‘specific loaders, multi”‘plugin frameworks, and shared infrastructure, along with Linux”‘focused…
-
The Recovery Illusion
When a cyber threat hits the headlines, the instinct is always the same. Organizations like to spend more, add another tool, and tighten the audit schedule so the box stays checked. But when ransomware hits a company that did all of that, the result usually still looks like chaos. Teams scramble and find out the..…
-
AiTM Phishing Becomes Top Initial Access Threat to Law Firms
AiTM phishing is now the top entry point into law firms, with identity behind 56% of threats First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/aitm-phishing-top-entry-point-law/
-
Minnesota Water Utility Attacks Expose Sector’s Cyber-Risks
A likely Iran-backed actor targeted more than 30 community water systems in Minnesota in a sobering reminder of rising threats to US critical infrastructure. First seen on darkreading.com Jump to article: www.darkreading.com/ics-ot-security/minnesota-water-utility-attacks-expose-sector-cyber-risks
-
Okta’s deal for Permiso aims to close gaps in identity threat detection
Ely Kahn, Okta’s chief product officer, told CyberScoop the deal enriches the company’s current threat detection tools and gives it deeper visibility into AI agent activity across enterprise systems. First seen on cyberscoop.com Jump to article: cyberscoop.com/okta-acquires-permiso-security-ai-identity-threat-detection/
-
Okta buys AI security startup Permiso, source says for about $200M
The deal gives Okta identity threat detection capabilities as enterprises seek to secure AI agents and other non-human identities across cloud environments. First seen on techcrunch.com Jump to article: techcrunch.com/2026/07/30/okta-buys-ai-security-startup-permiso-source-says-for-about-200m/
-
DPRK-Linked macOS Malvertising Uses Fake Updates to Deliver Crypto-Stealing Malware
Threat actors with ties to North Korea have been attributed to a sophisticated macOS malvertising campaign that involves redirecting users to fake web pages displaying a full-screen non-existent update sequence to deliver malware as part of a new iteration of the long-running Contagious Interview campaign.The defining aspect of the attack is that bogus macOS software…
-
Authorities investigating a coordinated cyberattack against Minnesota water systems
The two-day attack comes days after federal officials warned of state-linked threat groups targeting a wider set of industrial devices. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/authorities-investigating-a-coordinated-cyberattack-against-minnesota-water/826427/
-
FastJson RCE Zero-Day Actively Targets Organizations
Threat actors are actively exploiting the FastJson CVE-2026-16723 zero-day, with no patch available for affected FastJson 1.x versions. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/fastjson-rce-zero-day-actively-targets-organizations/
-
‘Certighost’ Flaw Haunts Microsoft Active Directory Certificates
Microsoft patched a high-severity vulnerability earlier this month that allows a threat actor to escalate privileges and compromise an AD environment. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/certighost-flaw-microsoft-active-directory-certificates
-
Companies fear AI risks more than common cybersecurity threats
That misprioritization could blind companies to the threats they should be focusing on, Arctic Wolf said in a new report. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/ai-cybersecurity-threats-business-fears/826352/
-
AI-assisted security tools are finding more bugs, but the threat level has not changed
Analysis from vulnerability intelligence firm VulnCheck shows AI-discovered flaws aren’t being exploited any faster than traditional ones. First seen on cyberscoop.com Jump to article: cyberscoop.com/ai-assisted-security-tools-are-finding-more-bugs-but-the-threat-level-has-not-changed/
-
Tanaka Dominates Data Leak Landscape With 25 Leak Posts
Ransomware often dominates cybersecurity headlines, but stolen data has become an equally valuable commodity in the cybercrime economy. In the first half of 2026, one threat actor stood out in the data leak ecosystem: Tanaka, a prolific data leak broker responsible for more publicized leak activity than any other actor tracked by Cyble. First seen…
-
Dismantled Kratos Phishing Kit Becomes Blueprint for Attacks on Microsoft 365 Users
The takedown of the Kratos phishing-as-a-service (PhaaS) platform in July 2026 has done little to slow the broader threat landscape. As security researchers warn that its leaked techniques and infrastructure patterns are already being repurposed in ongoing campaigns targeting Microsoft 365 environments. Despite being disrupted under Operation Olympus Blade, which led to the seizure of…
-
Microsoft Launches Flurry of AI Security Initiatives to Combat AI-Enabled Threats
Microsoft has launched a new agentic security system for cyber defenders as well as its first cyber-focused AI model First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/microsoft-ai-security-initiatives/
-
AWS to retire Shield Advanced L7 automatic mitigation on January 1, 2027
AWS Shield Advanced, a managed service that protects applications from external threats, is adding the Anti-DDoS managed rule group, designed for application-layer (L7) DDoS … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/07/28/aws-waf-anti-ddos-rule-group/
-
Dysphoria IoT Botnet Uses Blockchain Domains and 200,000 Devices for DDoS Attacks
A rapidly evolving IoT botnet dubbed “Dysphoria” has emerged as a significant global threat, leveraging blockchain-based domain resolution and a hybrid command-and-control (C2) architecture to sustain large-scale distributed denial-of-service (DDoS) operations. Dysphoria’s evolution has been unusually aggressive, transitioning from early jackskid-derived variants to more sophisticated fbot-based implementations within weeks. Initial samples observed in March 2026…
-
Hackers Pose as IT Helpdesk on Microsoft Teams to Deploy GoGRPC Backdoor
An evolving intrusion campaign in which threat actors impersonate IT helpdesk personnel via Microsoft Teams to gain initial access and deploy a custom Go-based backdoor dubbed “GoGRPC.” Active since January 2026, the activity is assessed to be linked to an initial access broker (IAB) operation that likely facilitates downstream ransomware attacks. Aligning with tactics observed…
-
Operation BlueDash Maintains Redundant Remote Access Even After One RMM Tool Is Removed
A newly analyzed phishing-driven intrusion set tracked as Operation BlueDash demonstrates how threat actors are operationalizing legitimate remote monitoring and management (RMM) tools to maintain persistent and redundant access to compromised environments. The infection chain begins with a Microsoft Teams-themed phishing email delivering a “secure document” lure. Victims are redirected through compromised infrastructur to a…
-
The Case for Human Authority in AI-Driven Cybersecurity
AI Can Detect Threats Fast, but Only Humans Can Judge and Own the Response As AI takes on more of cybersecurity’s workload, from threat detection to automated response, the real question isn’t how much autonomy machines should have; it’s who remains accountable when they act. This piece makes the case for human authority over AI-driven…
-
Insane Castle Hurricane: APT Codename Confusion Proliferates
Google Debuts Yet Another Way to Track State-Sponsored and Cybercrime Actors What do Castle, Ion, Neptune, Relic and Comet have in common? They’re among the codenames Google will begin assigning to threat groups, many of which already have a dozen different codenames assigned to them. In the words of one researcher: There is a massive…
-
Dysphoria IoT Botnet Adds Blockchain C2 and Victim Relays After JackSkid Disruption
Dysphoria, an Internet of Things (IoT) botnet line tracked by CNCERT and XLab, has adopted blockchain-based name services and infected-device relays after a March law-enforcement operation against JackSkid infrastructure. The researchers say the design makes the botnet harder to disrupt.CNCERT, China’s national computer emergency response team, and XLab, the threat-intelligence lab of Chinese First seen…
-
27th July Threat Intelligence Report
Nichirei, a Japan-based frozen-food supplier and logistics company, has experienced a ransomware attack that disrupted shipping operations and affected approximately 5,000 customers. KFC Japan warned of possible shortages. Nichirei confirmed personal data theft, […] First seen on research.checkpoint.com Jump to article: research.checkpoint.com/2026/27th-july-threat-intelligence-report/
-
âš¡ Weekly Recap: Rogue AI Agents, Check Point Exploit, Slopsquatting, ClickFix Lures and More
Monday starts with the usual promise that everything is under control. Then the logs wake up.This week, trusted tools crossed lines, old flaws found new work, exposed systems stayed exposed, and attackers kept hiding inside normal-looking services. Nothing looked strange at first. That helped.That is the mood. Here is the full recap.âš¡ Threat of the…
-
Anubis Warum ein Patch allein nicht ausreicht
Bereits Anfang Juli berichtete das Arctic Wolf Labs-Team von wichtigen Erkenntnissen rund um die Anubis-Ransomware. Und die Gefahr, die durch die Cyberkampagne ausgeht, ist noch lange nicht gebannt. Stefan Hostetler, Staff Threat Intelligence Researcher bei Arctic Wolf, gibt seine Einschätzung zum Risiko, das von der Anubis-Ransomware ausgeht und welche Schritte Unternehmen zur Abwehr ergreifen sollten.…
-
Google changes how it names cyber threat actors
Google Threat Intelligence Group (GTIG) has started using a new naming system for the threat actors it tracks. The change comes after Mandiant and Google’s Threat … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/07/27/google-threat-actors-naming-system/
-
Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide Windows Malware
The China-linked cybercrime group behind the use of income tax-related phishing lures targeting Indian taxpayers, tax professionals, and corporate finance teams has been observed using a sophisticated crypter service called Cruciferra.According to a new analysis by Proofpoint, Cruciferra has been utilized by various unrelated cybercriminal threat clusters to deliver a wide array of remote First…
-
Crypto Criminals Use Social Media Profiling to Select Victims for Violent Wrench Attacks
Crypto criminals are increasingly weaponizing social media intelligence to identify and target high-value individuals in a surge of violent “wrench attacks,” marking a shift from purely digital exploitation to coordinated physical coercion campaigns. Recent threat intelligence indicates that attackers are systematically profiling cryptocurrency holders using publicly available data across platforms such as Instagram, TikTok, X,…
-
TELESHIM Abuses Telegram for C2 in Attacks Against Middle East Governments
Cybersecurity researchers have flagged fresh malicious cyber activity by a threat actor with ties to East Asia targeting government entities in the Middle East.The intrusions have resulted in the deployment of previously unreported malware families dubbed TELESHIM, MIXEDKEY, and BINDCLOAK, according to Zscaler ThreatLabz. The cybersecurity firm said it detected the campaign earlier this month.…
-
Iranian Hackers Exploit Rockwell, Schneider and Siemens PLCs Across U.S. Critical Infrastructure
Tags: advisory, automation, cisa, cyber, cybersecurity, exploit, hacker, infrastructure, Internet, iran, technology, threatIranian-affiliated advanced persistent threat (APT) actors are actively exploiting internet-connected programmable logic controllers (PLCs) from major industrial vendors, including Rockwell Automation, Schneider Electric, and Siemens, targeting U.S. critical infrastructure sectors. A joint cybersecurity advisory (AA26-097A) released by the FBI, CISA, NSA, DOE, EPA, Treasury, and U.S. Cyber Command highlights sustained exploitation activity against operational technology…