Tag: threat
-
UK cyber chief urges ‘full court press’ to counter rising cyber threats
In a keynote speech at the RSA Conference, National Cyber Security Centre (NCSC) CEO Richard Horne said cyber risks are now “of greater consequence than ever before.” First seen on therecord.media Jump to article: therecord.media/uk-cyber-chief-urges-full-court-press-to-counter-risks
-
Why AI agents are one prompt away from ransomware
As AI adoption advances beyond chatbots, security leaders are up against rogue AI agents mirroring threat actors and a generational skills gap as security operations teams become overly dependent on AI First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366640722/Why-AI-agents-are-one-prompt-away-from-ransomware
-
Gemini picks up criminal activity buried in dark web noise
To help teams make faster and more accurate decisions on emerging threats, Google has introduced a dark web intelligence capability in Google Threat Intelligence. Powered by … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/03/25/google-dark-web-intelligence-capability/
-
Mirai Botnets Evolve Into Major DDoS and Proxy Abuse Threats
Mirai-based botnets have evolved from simple IoT malware into large-scale DDoS and proxy abuse platforms that now underpin record-breaking attacks and stealthy cybercrime operations. In total, over 21,000 C2 servers were observed between July and December 2025, with a notable shift towards abusing bots as residential proxies in addition to classic DDoS use. This growth…
-
The Kill Chain Is Obsolete When Your AI Agent Is the Threat
In September 2025, Anthropic disclosed that a state-sponsored threat actor used an AI coding agent to execute an autonomous cyber espionage campaign against 30 global targets. The AI handled 80-90% of tactical operations on its own, performing reconnaissance, writing exploit code, and attempting lateral movement at machine speed.This incident is worrying, but there’s a scenario…
-
TeamPCP Expands Supply Chain Campaign With LiteLLM PyPI Compromise
Python package LiteLLM compromised with credential-stealing malware linked to TeamPCP threat group First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/teampcp-litellm-pypi-supply-chain/
-
ClawHub Vulnerability Lets Attackers Manipulate Rankings to Become Top Skill
Silverfort researchers recently uncovered a critical security flaw in ClawHub, the main public registry for the OpenClaw agent ecosystem. This vulnerability allowed attackers to artificially boost download numbers, pushing malicious code to the top of the search results. This created a massive supply chain risk that could allow threat actors to run dangerous code on…
-
Malicious LiteLLM versions linked to TeamPCP supply chain attack
TeamPCP backdoored LiteLLM v1.82.71.82.8, likely via Trivy CI/CD, adding tools to steal credentials, move in Kubernetes, and keep persistent access. Threat actor TeamPCP compromised LiteLLM versions 1.82.7 and 1.82.8, likely through a Trivy CI/CD breach. LiteLLM, with over 95 million monthly downloads, helps developers route LLM requests via a single API. The malicious releases, now…
-
Malicious LiteLLM versions linked to TeamPCP supply chain attack
TeamPCP backdoored LiteLLM v1.82.71.82.8, likely via Trivy CI/CD, adding tools to steal credentials, move in Kubernetes, and keep persistent access. Threat actor TeamPCP compromised LiteLLM versions 1.82.7 and 1.82.8, likely through a Trivy CI/CD breach. LiteLLM, with over 95 million monthly downloads, helps developers route LLM requests via a single API. The malicious releases, now…
-
TeamPCP Backdoors LiteLLM Versions 1.82.71.82.8 via Trivy CI/CD Compromise
TeamPCP, the threat actor behind the recent compromises of Trivy and KICS, has now compromised a popular Python package named litellm, pushing two malicious versions containing a credential harvester, a Kubernetes lateral movement toolkit, and a persistent backdoor.Multiple security vendors, including Endor Labs and JFrog, revealed that litellm versions 1.82.7 and 1.82.8 were published on…
-
Compromised LiteLLM Package With 95M Downloads Tied to TeamPCP, After Trivy KICS Hacks
Security researchers discovered that the popular Python library litellm was compromised on PyPI. With over 95 million monthly downloads, this open-source tool helps developers route requests across various LLM providers through a single API. The threat actor, identified as TeamPCP, injected malicious code into versions 1.82.7 and 1.82.8. This devastating supply chain attack directly follows the group’s…
-
Compromised LiteLLM Package With 95M Downloads Tied to TeamPCP, After Trivy KICS Hacks
Security researchers discovered that the popular Python library litellm was compromised on PyPI. With over 95 million monthly downloads, this open-source tool helps developers route requests across various LLM providers through a single API. The threat actor, identified as TeamPCP, injected malicious code into versions 1.82.7 and 1.82.8. This devastating supply chain attack directly follows the group’s…
-
Beyond Intel Sharing: The Push Toward Cyber Disruption
Google Threat Intelligence’s Sandra Joyce on AI Threats and Active Defense. Sharing threat intelligence is no longer enough – the cybersecurity industry must operationalize it through coordinated takedowns and active disruption, says Sandra Joyce, vice president at Google Threat Intelligence. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/beyond-intel-sharing-push-toward-cyber-disruption-a-31160
-
Aqua Security’s Trivy Scanner Hit by Supply Chain Attack, Threatening Software Integrity
Tags: attack, cyber, github, malicious, open-source, risk, software, supply-chain, threat, vulnerabilityA sophisticated supply chain attack compromised Aqua Security’s popular open-source Trivy vulnerability scanner. Threat actors successfully distributed malicious code through the project’s GitHub Actions, targeting deployment pipelines to silently exfiltrate sensitive credentials. While Aqua’s commercial products remain completely unaffected, the incident highlights the severe risks of using mutable version tags in deployment automation. The attack…
-
How Quantum Threats Drive Encryption Changes
Alex Doll of Ten Eleven Ventures on Q-Day Risk Considerations. Quantum computing advances push security teams to replace encryption keys faster and adopt quantum-resistant algorithms. Investors and enterprises now treat Q-Day as a near-term risk, forcing changes in key management, PKI and cryptographic standards, says Alex Doll of Ten Eleven Ventures. First seen on govinfosecurity.com…
-
PTC warns of imminent threat from critical Windchill, FlexPLM RCE bug
PTC Inc. is warning of a critical vulnerability in Windchill and FlexPLM, widely used product lifecycle management (PLM) solutions, that could allow remote code execution. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/ptc-warns-of-imminent-threat-from-critical-windchill-flexplm-rce-bug/
-
Checkmarx KICS Code Scanner Targeted in Widening Supply Chain Hit
TeamPCP is the likely cyber threat actor behind attacks on Trivy, Checkmarx’s KICS and VS Code plug-ins, and the LiteLLM AI library, and all signs point to more attacks to come. First seen on darkreading.com Jump to article: www.darkreading.com/application-security/checkmarx-kics-code-scanner-widening-supply-chain
-
TeamPCP Backdoors LiteLLM Versions 1.82.71.82.8 Likely via Trivy CI/CD Compromise
TeamPCP, the threat actor behind the recent compromises of Trivy and KICS, has now compromised a popular Python package named litellm, pushing two malicious versions containing a credential harvester, a Kubernetes lateral movement toolkit, and a persistent backdoor.Multiple security vendors, including Endor Labs and JFrog, revealed that litellm versions 1.82.7 and 1.82.8 were published on…
-
Google Unleashes Gemini AI to Scour Dark Web for Corporate Threats
Google has launched a new dark web intelligence service to tackle the grueling task of monitoring underground criminal forums. It is deploying Gemini-powered artificial intelligence (AI) agents to sift through upwards of 10 million posts daily, the tech giant said, to replace clunky, keyword-based legacy systems with a platform that understands the context of a..…
-
Cy4Data Labs Brings Real-Time Insider Threat Detection to RSAC 2026
Cy4Data Labs announced at RSAC 2026 that its flagship platform Cy4Secure now includes a Behavior Engine for insider threat detection, designed to bring the time it takes to identify and contain a data breach from more than 200 days down to seconds. The Behavior Engine is built around a three-phase response model: Detect, Deny, Eject……
-
FCC bans import of consumer-grade routers amid national security concerns
The decision follows years of escalating attacks against the U.S. from state-linked threat groups targeting routers and edge devices. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/fcc-bans-import-consumer-grade-routers-national-security/815528/
-
How a Large Bank Uses AI Digital Twins for Threat Hunting
JPMorgan Chase uses digital fingerprints and digital twins to spot online attackers and malicious behaviors while also reducing pesky false alerts. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/untitled
-
AI Forces CISOs to Rebuild Defense Playbooks
Francis deSouza of Google Cloud on Fighting AI-Driven Threats With AI. AI has redrawn the threat landscape for security leaders and forced a new operating model. Francis deSouza of Google Cloud says CISOs must counter faster, AI-driven attacks with AI-led defense, stronger governance and teams fluent in AI. First seen on govinfosecurity.com Jump to article:…
-
Huntress Brings ITDR to Google Workspace as Identity Attacks Surge
Huntress has announced it is extending its Managed Identity Threat Detection and Response (ITDR) solution to Google Workspace, marking a significant expansion of the company’s cloud identity security coverage and coming at a telling moment. The announcement, made today at RSA Conference in San Francisco, coincides with Huntress surpassing 10 million Microsoft 365 identities protected…
-
Infinite Campus warns of breach after ShinyHunters claims data theft
Infinite Campus, a widely used K-12 student information system, is warning customers of a data breach following an extortion attempt by a threat actor. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/infinite-campus-warns-of-breach-after-shinyhunters-claims-data-theft/
-
New ‘StoatWaffle’ malware auto”‘executes attacks on developers
Tags: attack, detection, group, infrastructure, jobs, korea, malicious, malware, north-korea, threatContagious Interview, revisited: StoatWaffle isn’t an isolated campaign. It’s the latest chapter in the Contagious Interview attacks, widely attributed to North Korea-linked threat actors tracked as WaterPlum.Historically, this campaign has targeted developers and job seekers through fake interview processes, luring them into running malicious code under the guise of technical assessments. Previously, the campaign weaponized…
-
DarkSword Exploit Chain Leaked Online, Posing Risk to Millions of iPhones
Security researchers have confirmed that the sophisticated iOS exploit chain known as DarkSword is now accessible outside of its original threat actor groups. Recently, security researcher @matteyeux successfully achieved kernel read/write access on an iPad mini 6th generation running iOS 18.6.2 using the in-the-wild DarkSword exploit. This development demonstrates that the exploit kit is highly…
-
Microsoft Proposes Better Identity, Guardrails for AI Agents
Companies need better controls to manage key threats rising from the growth of agentic AI. These new features provide a starting point. First seen on darkreading.com Jump to article: www.darkreading.com/identity-access-management-security/microsoft-proposes-better-identity-guardrails-ai-agents
-
Enterprise Cybersecurity Software Fails 20% of the Time, Warns Absolute Security
Poor patch management, increasingly complex IT environments and continued use of obsolete software puts organizations at risk from cyber threats, says the Absolute Security 2026 Resilience Risk Index First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/cybersecurity-software-failure-20/