Tag: threat
-
CVE-2026-1731 fuels ongoing attacks on BeyondTrust remote access products
Attackers are exploiting CVE-2026-1731 in BeyondTrust RS and PRA to deploy VShell, gain persistence, move laterally, and control compromised systems. Threat actors are actively exploiting a recently disclosed critical vulnerability, tracked as CVE-2026-1731 (CVSS score: 9.9), in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA). The flaw is being used to conduct a wide…
-
Russian Cyber Threat Actor Uses GenAI to Compromise Fortinet Firewalls
A low-skilled Russian-speaking attacker has used GenAI tools to help deploy a successful attack workflow targeting FortiGate instances First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/russian-threat-actor-genai/
-
Attackers exploit Ivanti EPMM zero-days to seize control of MDM servers
Patch, but verify first: Unit 42 directed organizations to Ivanti’s security advisory for remediation guidance, which recommends applying version-specific RPM patches for EPMM 12.x branches that require no appliance downtime. Ivanti cautioned, however, that the patch does not survive a version upgrade and must be reinstalled if the software is updated. “The permanent fix for…
-
AI-powered campaign compromises 600 FortiGate systems worldwide
A Russian-speaking cybercriminal used commercial generative AI tools to hack over 600 FortiGate devices across 55 countries. Amazon Threat Intelligence reports that a Russian-speaking, financially motivated threat actor used commercial generative AI services to compromise more than 600 FortiGate devices in 55 countries. The activity, observed between January 11 and February 18, 2026, highlights how…
-
CISA Warns of Actively Exploited Roundcube Vulnerabilities
Tags: cisa, cve, cyber, cybersecurity, exploit, flaw, infrastructure, kev, open-source, risk, threat, vulnerabilityOn February 20, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) updated its Known Exploited Vulnerabilities (KEV) Catalog by adding two critical flaws in Roundcube Webmail. These vulnerabilities, CVE-2025-49113 and CVE-2025-68461, are being actively exploited by threat actors. Roundcube, a popular open-source webmail client used by organizations worldwide, now faces heightened risks as attackers target…
-
CISA Warns of Actively Exploited Roundcube Vulnerabilities
Tags: cisa, cve, cyber, cybersecurity, exploit, flaw, infrastructure, kev, open-source, risk, threat, vulnerabilityOn February 20, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) updated its Known Exploited Vulnerabilities (KEV) Catalog by adding two critical flaws in Roundcube Webmail. These vulnerabilities, CVE-2025-49113 and CVE-2025-68461, are being actively exploited by threat actors. Roundcube, a popular open-source webmail client used by organizations worldwide, now faces heightened risks as attackers target…
-
North Korean Hackers Exploit Fake IT Worker Schemes and Malicious Interview Lures
North Korean state-backed hackers are running large-scale fake IT worker and “Contagious Interview” campaigns that abuse developer hiring workflows to deliver JavaScript-based malware, steal code and credentials, and covertly generate revenue for the regime. Since at least 2022, North Korean threat actors have impersonated recruiters and hiring managers, luring software developers into executing booby-trapped code…
-
DPRK-Linked Hackers Continue Aggressive Crypto Attacks One Year After Bybit Breach
DPRK-linked operators are maintaining a relentless focus on the crypto sector, with activity accelerating rather than slowing in the year since the record-breaking Bybit breach. On 21 February 2025, threat actors linked to North Korea stole around 1.46 billion dollars in cryptoassets from Dubai-based exchange Bybit, in what remains the largest confirmed crypto theft to date. By…
-
Attacker Breached 600 FortiGate Appliances in AI-Assisted Campaign: Amazon
An single threat actor used AI tools to create and run a campaign that compromised more then 600 Fortinet FortiGate appliances around the world over five weeks, according to Amazon threat researchers, the latest example of how cybercriminals are using the technology in their attacks. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/02/attacker-breached-600-fortigate-appliances-in-ai-assisted-campaign-amazon/
-
Why are cybersecurity experts optimistic about NHIDR
Are Non-Human Identities the New Frontier in Cybersecurity? Where cyber threats loom large, an often-overlooked challenge is the protection and management of Non-Human Identities (NHIs). Cybersecurity is evolving rapidly, and professionals across various sectors are increasingly recognizing the strategic importance of NHIs. But what exactly are these identities, and why should cybersecurity experts be optimistic……
-
What role does Agentic AI play in identity and access management
How Do Non-Human Identities Transform Cloud Security? Are your organization’s security measures keeping pace with evolving threats? The rise of Non-Human Identities (NHIs) is reshaping how we approach cloud security by closing gaps that have long persisted between security and R&D teams. Where businesses increasingly migrate to cloud environments, the effective management of these machine……
-
How are SOC teams empowered by Non-Human Identities
Can SOC Teams Really Rely on Non-Human Identities for Cybersecurity? SOC (Security Operations Center) teams are continually challenged to adapt and respond to emerging cybersecurity vulnerabilities. When threats evolve, traditional security measures can often fall short. This is where Non-Human Identities (NHIs) come into play, offering innovative solutions to bolster security protocols. Understanding the Concept……
-
AI-Assisted Threat Actor Compromises 600+ FortiGate Devices in 55 Countries
A Russian-speaking, financially motivated threat actor has been observed taking advantage of commercial generative artificial intelligence (AI) services to compromise over 600 FortiGate devices located in 55 countries.That’s according to new findings from Amazon Threat Intelligence, which said it observed the activity between January 11 and February 18, 2026.”No exploitation of FortiGate First seen on…
-
How does Agentic AI enforce cloud compliance in real-time
The Critical Role of Agentic AI in Enhancing Cloud Compliance Monitoring How do organizations ensure their cloud systems remain compliant in real-time amidst evolving threats? The implementation of Agentic AI in compliance monitoring has emerged as a proactive strategy for bridging the security gap in cloud environments, especially when it comes to Non-Human Identities (NHIs)….…
-
Attackers Use New Tool to Scan for React2Shell Exposure
Researchers say threat actors wielded the sophisticated, and unfortunately named, toolkit to target high-value networks for React2Shell exploitation. First seen on darkreading.com Jump to article: www.darkreading.com/application-security/attackers-new-tool-scan-react2shell-exposure
-
TDL 016 – Speed, Risk, and Responsibility in the Age of AI – Rafael Ramirez
Tags: access, ai, antivirus, automation, awareness, business, ciso, cloud, control, country, cyber, data, defense, detection, dns, firewall, governance, government, hacker, ibm, incident response, intelligence, Internet, law, linkedin, login, mfa, microsoft, network, risk, saas, service, skills, software, startup, strategy, technology, threat, tool, training, update, vulnerability, windows, zero-trustSummary In a recent episode of The Defenders Log, host David Redekop sat down with cyber security expert Rafael Ramirez to navigate the rapidly shifting landscape of AI security. As we move deeper into 2026, the duo explored how artificial intelligence has evolved from simple chatbots into powerful, autonomous “agentic” systems. The Double-Edged Sword of…
-
QA: Organisations Are Spending Millions on Cybersecurity and Still Getting It Wrong
Cybersecurity threats continue to escalate in scale, speed and sophistication, placing growing pressure on organisations to move beyond reactive defences and rethink how risk is governed at leadership level. As digital systems underpin everything from national infrastructure to day-to-day business operations, failures in governance, communication and accountability are increasingly being exposed as critical vulnerabilities. At…
-
BeyondTrust Flaw Used for Web Shells, Backdoors, and Data Exfiltration
Threat actors have been observed exploiting a recently disclosed critical security flaw impacting BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) products to conduct a wide range of malicious actions, including deploying VShell and The vulnerability, tracked as CVE-2026-1731 (CVSS score: 9.9), allows attackers to execute operating system commands in the context of the…
-
BeyondTrust Flaw Used for Web Shells, Backdoors, and Data Exfiltration
Threat actors have been observed exploiting a recently disclosed critical security flaw impacting BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) products to conduct a wide range of malicious actions, including deploying VShell and The vulnerability, tracked as CVE-2026-1731 (CVSS score: 9.9), allows attackers to execute operating system commands in the context of the…
-
Dynamic Objects in Active Directory: The Stealthy Threat
Active Directory’s “dynamic objects” feature offers attackers a perfect evasion cloak. These objects automatically self-destruct without a trace, so they allow adversaries to bypass quotas, pollute access lists, and persist in the cloud, leaving forensic investigators with nothing to analyze. Key takeaways The threat: Dynamic objects self-delete without leaving any traces, or “tombstones” in AD…
-
Turning Security Alerts into Actionable Defense
In today’s threat landscape, cyberattacks are no longer isolated incidents they are continuous, automated, and increasingly sophisticated. Organizations must move beyond traditional monitoring and adopt intelligent, real-time detection platforms capable of identifying both known and emerging threats. Seceon’s aiSIEM platform exemplifies this next-generation approach by delivering contextualized, behavior-driven security intelligence. The following real-world attack First…
-
Silicon Valley Engineers Indicted for Alleged Trade Secret Theft From Google and Tech Firms
Federal authorities arrested three Silicon Valley engineers on Thursday, charging them with conspiring to steal trade secrets from Google and other tech giants. The case highlights growing insider threats in the chip design sector, where foreign adversaries could exploit sensitive data on processor security and cryptography. Samaneh Ghandali, 41, her husband Mohammadjavad Khosravi (aka Mohammad…
-
FBI: Threats from Salt Typhoon are ‘still very much ongoing’
A top FBI cyber official said Salt Typhoon, the Chinese cyber espionage group behind the widespread compromise of U.S. telecommunications infrastructure in 2024, continues to pose a broad threat to both America’s private and public sectors. Michael Machtinger, deputy assistant director for cyber intelligence at the FBI, touted improved partnerships between the telecommunications industry and…
-
Latin America’s Cyber Maturity Lags Threat Landscape
The slower pace of upgrades has the unintended impact of creating a haven for attackers, especially for initial access brokers and ransomware gangs. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/latin-americas-cyber-maturity-lags-threat-landscape
-
AI in the SOC: Why Complete Autonomy Is the Wrong Goal
Dan Petrillo, VP of Product at BlueVoyant As artificial intelligence (AI) becomes more deeply embedded in security operations, a divide has emerged in how its role is defined. Some argue the security operations centre (SOC) should be fully autonomous, with AI replacing human analysts. Others believe that augmentation is the right path, using AI to support and extend existing teams. Augmentation probably reflects…
-
AI in the SOC: Why Complete Autonomy Is the Wrong Goal
Dan Petrillo, VP of Product at BlueVoyant As artificial intelligence (AI) becomes more deeply embedded in security operations, a divide has emerged in how its role is defined. Some argue the security operations centre (SOC) should be fully autonomous, with AI replacing human analysts. Others believe that augmentation is the right path, using AI to support and extend existing teams. Augmentation probably reflects…