Tag: threat
-
SLOTAGENT Malware Hides API Calls and Strings to Thwart Analysis
A previously unknown remote access trojan (RAT), dubbed SLOTAGENT, after analyzing a suspicious ZIP archive uploaded from Japan to a public malware repository in early 2026. The malware demonstrates advanced evasion techniques and flexible post-exploitation capabilities, making it a notable addition to the evolving threat landscape. The ZIP file contains a malicious executable, WindowsOobeAppHost.AOT.exe, which triggers the…
-
SLOTAGENT Malware Hides API Calls and Strings to Thwart Analysis
A previously unknown remote access trojan (RAT), dubbed SLOTAGENT, after analyzing a suspicious ZIP archive uploaded from Japan to a public malware repository in early 2026. The malware demonstrates advanced evasion techniques and flexible post-exploitation capabilities, making it a notable addition to the evolving threat landscape. The ZIP file contains a malicious executable, WindowsOobeAppHost.AOT.exe, which triggers the…
-
Purple Team
Purple Team Simulation Contact Us Solution Brief Overview Today’s cyber threats are no longer theoretical. Attackers operate with patience, precision, and a clear understanding of how to exploit gaps across technology, process, and people. Traditional security assessments often identify vulnerabilities, but they do not always answer the questions executives and security leaders care about most:……
-
Vect 2.0 RaaS Expands Attacks Across Windows, Linux, and ESXi
Vect 2.0 Ransomware”‘as”‘a”‘Service (RaaS) operation is rapidly evolving into a multi”‘platform threat that can encrypt Windows, Linux, and VMware ESXi environments across modern hybrid infrastructures. The group runs a classic affiliate model, renting out its ransomware and TOR”‘based infrastructure to partners in exchange for a share of ransom payments. Its operators are strongly suspected to be…
-
LiteLLM CVE-2026-42208 SQL Injection Exploited within 36 Hours of Disclosure
In yet another instance of threat actors quickly jumping on the exploitation bandwagon, a newly disclosed critical security flaw in BerriAI’s LiteLLM Python package has come under active exploitation in the wild within 36 hours of the bug becoming public knowledge.The vulnerability, tracked as CVE-2026-42208 (CVSS score: 9.3), is an SQL injection that could be…
-
How a Long-Lived API Credential Let an AI Agent Delete Production Data
4 min readWhat began as a routine staging task for a SaaS startup ended in a disaster that would have been unthinkable just months ago: an AI agent operating as a super insider threat and triggering a worst-case production failure. In a detailed X post, Jer Crane, founder of PocketOS, a software platform for the…
-
How a Long-Lived API Credential Let an AI Agent Delete Production Data
4 min readWhat began as a routine staging task for a SaaS startup ended in a disaster that would have been unthinkable just months ago: an AI agent operating as a super insider threat and triggering a worst-case production failure. In a detailed X post, Jer Crane, founder of PocketOS, a software platform for the…
-
How a Long-Lived API Credential Let an AI Agent Delete Production Data
4 min readWhat began as a routine staging task for a SaaS startup ended in a disaster that would have been unthinkable just months ago: an AI agent operating as a super insider threat and triggering a worst-case production failure. In a detailed X post, Jer Crane, founder of PocketOS, a software platform for the…
-
6 Best Intrusion Detection Prevention Systems in 2026
IDPS tools monitor network traffic, detect threats, and help teams respond effectively. Learn about the top IDPS solutions in 2026. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/products/intrusion-detection-and-prevention-systems/
-
NSA Chief During Snowden Affair Shares Regrets, Reflections 13 Years Later
Chris Inglis was the head civilian in charge at the NSA when the Snowden leak exploded. He gets candid about mistakes the organization made, and what CISOs need to know about spotting potential threats, media disclosures, and enculturation. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/nsa-chief-during-snowden-affair-13-years-later
-
Checkmarx confirms LAPSUS$ hackers leaked its stolen GitHub data
Application security company Checkmarx has confirmed that the LAPSUS$ threat group leaked data stolen from its private GitHub repository. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/checkmarx-confirms-lapsus-hackers-leaked-its-stolen-github-data/
-
VECT 2.0 Ransomware Irreversibly Destroys Files Over 131KB on Windows, Linux, ESXi
Threat hunters are warning that the cybercriminal operation known as VECT 2.0 acts more like a wiper than a ransomware due to a critical flaw in its encryption implementation across Windows, Linux, and ESXi variants that renders recovery impossible even for the threat actors.The fact that VECT’s locker permanently destroys large files rather than encrypting…
-
North Korean Hackers Target Drug Companies in New Cyber Campaign
Pharmaceutical companies sit at the intersection of innovation, intellectual property, and global supply chains. This makes them highly attractive targets for nation-state actors seeking both strategic and financial advantage. New reporting from Cybersecurity News reveals that North Korean threat actors are actively targeting pharmaceutical organizations, aiming to compromise systems and access sensitive research and operational…
-
North Korean Hackers Target Drug Companies in New Cyber Campaign
Pharmaceutical companies sit at the intersection of innovation, intellectual property, and global supply chains. This makes them highly attractive targets for nation-state actors seeking both strategic and financial advantage. New reporting from Cybersecurity News reveals that North Korean threat actors are actively targeting pharmaceutical organizations, aiming to compromise systems and access sensitive research and operational…
-
North Korean Hackers Target Drug Companies in New Cyber Campaign
Pharmaceutical companies sit at the intersection of innovation, intellectual property, and global supply chains. This makes them highly attractive targets for nation-state actors seeking both strategic and financial advantage. New reporting from Cybersecurity News reveals that North Korean threat actors are actively targeting pharmaceutical organizations, aiming to compromise systems and access sensitive research and operational…
-
Inside an OPSEC Playbook: How Threat Actors Evade Detection
Threat actors are now publishing structured OPSEC playbooks to stay undetected. Flare reveals how these guides outline layered infrastructure, identity separation, and long-term evasion strategies. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/inside-an-opsec-playbook-how-threat-actors-evade-detection/
-
Fake Tax Audits and Updates Fuel Silver Fox Malware Campaign
A China-linked threat group known as Silver Fox is running a new wave of cyber campaigns using fake tax audit notifications and software update lures to deliver malware across Asia. Active since at least 2022, the group initially focused on financially motivated attacks but, since 2024, has evolved into a dual-purpose operation combining cybercrime and…
-
Stopping AiTM attacks: The defenses that actually work after authentication succeeds
Tags: 2fa, access, attack, authentication, awareness, breach, communications, compliance, control, credentials, data, defense, detection, email, finance, framework, identity, incident response, login, mfa, microsoft, monitoring, nist, passkey, phishing, risk, service, threat, tool, trainingThe 3 controls that close the gap: Control #1: Bind sessions to managed devices The most impactful single control for session security is requiring managed, compliant devices as a condition of accessing sensitive resources. When access policies, such as Microsoft Entra Conditional Access, require that the device presenting a session token is enrolled, managed and…
-
Beyond the perimeter: Why identity and cyber security are one single story
By James Odom, Director of Cyber, and Jim Small, Director of Identity at Hippo Digital For years, identity and cyber security have been treated as separate disciplines, with identity focusing on authentication, onboarding and access and cyber security focusing on networks, monitoring and threat response. That separation made sense when systems had clearer boundaries. The…
-
Sandworm Uses SSH-over-Tor Tunnel for Stealthy Long-Term Persistence
A significant evolution in Sandworm (APT-C-13) tradecraft, revealing the group’s use of SSH-over-Tor tunneling to achieve long-term, covert persistence inside targeted networks. Sandworm, also known as FROZENBARENTS, is a state-sponsored threat group active since 2014. It has consistently targeted government bodies, energy firms, and research institutions, focusing on intelligence collection. The attack begins with spear-phishing…
-
Chinese Silk Typhoon Hacker Extradited to U.S. Over COVID Research Cyberattacks
A Chinese national accused of being a member of the Silk Typhoon hacking group has been extradited to the U.S. from Italy. Xu Zewei, 34, was arrested in July 2025 by Italian authorities for his alleged links to the Chinese state-sponsored threat group and for orchestrating cyber attacks against American organizations and government agencies between…
-
Artifact Poisoning: A Silent Threat to Enterprise Software Supply Chains
Software supply chains have quietly become one of the most critical and most vulnerable foundations of modern enterprises. Today, applications are no longer monolithic systems built entirely in-house. Instead, they are complex assemblies of open-source libraries, third-party packages, container images, APIs, and pre-built binaries pulled from multiple repositories. This interconnected ecosystem has dramatically improved speed,……
-
OilRig Hides C2 Config in Google Drive Image via LSB Steganography
APT-C-49 (OilRig), an Iranian state-sponsored advanced persistent threat group also known as APT34 and Helix Kitten, has deployed a sophisticated new attack campaign that conceals command-and-control configurations inside Google Drive images using LSB steganography. The group, which has been active since at least 2014, primarily targets government, energy, telecommunications, and financial sectors across the Middle…
-
Neue Managed Services stellen die Weichen für digitale Souveränität
Controlware betreibt Cloud-basiertes Security Operations Center auf Basis von Sekoia.io Controlware erweitert das Managed Service-Portfolio um neue, digital souveräne SOC-Services auf Basis der europäischen Threat-Detection-&-Response-Plattform Sekoia.io. Das Angebot richtet sich an mittelständische und große Unternehmen sowie öffentliche Einrichtungen, die ihre Cyberabwehr stärken und gleichzeitig wachsenden Anforderungen an Datenhoheit, regulatorische Sicherheit und technologische Unabhängigkeit gerecht… First…
-
Fake Document Reader App Hits 10K Downloads, Spreads Anatsa Malware
A newly discovered malicious Android application masquerading as a document reader was found on the Google Play Store, infecting users with the notorious Anatsa banking trojan. The app, which had already surpassed 10,000 downloads before its removal, highlights the ongoing threat of malware slipping through official app marketplaces. The malicious app was hosted on the…
-
Robinhood account creation flaw abused to send phishing emails
Online trading platform Robinhood’s account creation process was exploited by threat actors to inject phishing messages into legitimate emails, tricking users into believing their accounts had suspicious activity. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/robinhood-account-creation-flaw-abused-to-send-phishing-emails/
-
Top 7 Threat Intelligence Platforms Software in 2026
Discover top threat intelligence platforms, including their features, use cases, and comparisons in 2026. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/products/threat-intelligence-platforms/
-
ADT Breach Exposes Data of 5.5 Million Customers, ShinyHunters Likely Behind Attack
The ShinyHunters extortion group is claiming responsibility for a breach of home and commercial security vendor ADT that exposed the data of 5.5 million customers. attack appears to be part of a larger and ongoing vishing campaign being run by the prolific threat actors. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/04/adt-breach-exposes-data-of-5-5-million-customers-shinyhunters-likely-behind-attack/