Tag: attacks

Learn how east-west traffic visibility helps detect and stop lateral movement attacks inside electric grid infrastructure and critical OT networks.

Ransomware’s Opening Play: Target Identity First

March 17, 2026

For years, ransomware attacks followed a familiar script. Threat actors gained entry through a vulnerable server, a phishing email, or malicious software on an endpoint. Once inside, they moved laterally through the network, then encrypted systems and demanded payment. That playbook has changed. Today’s ransomware operators increasingly target identity infrastructure as their first objective. Active…

Surge in Nation State Attacks on UK Firms Amid Cyber Warfare Fears

March 17, 2026

Armis reveals that “mutually assured disruption” is no longer preventing state-backed attacks

New XWorm 7.1 and Remcos RAT Attacks Abuse Windows Tools to Evade Detection

March 16, 2026

New XWorm 7.1 and Remcos RAT campaigns abuse trusted Windows tools to evade detection. The attacks exploit a WinRAR flaw and use process hollowing to spy on victims.

Global Study Exposes Critical Gap Between Cyberattack Detection and Containment

March 15, 2026

GUEST RESEARCH: 95% are confident they can detect attacks, but nearly half struggle to stop them as AI-driven threats accelerate

Starbucks data breach impacts 889 employees

March 14, 2026

Starbucks disclosed a breach after phishing attacks on its employee portal led to unauthorized access to Partner Central accounts, exposing staff data. Starbucks reported a data breach affecting hundreds of employees after phishing attacks targeted its Partner Central employee portal. The security breach was detected on February 6, the incident involved unauthorized access to staff…

Cyber criminals too are working from home… your home

March 13, 2026

The FBI is so concerned about the threat of residential proxy attacks and the dangers posed by cyber criminals using the technique that it has posted guidance on its website. Residential proxies are used by cybercriminals to reroute traffic between individuals and the websites they visit to make it appear to originate elsewhere? By taking…

Cyber criminals too are working from home… your home

March 13, 2026

Will AI Save Consumers From Smartphone-Based Phishing Attacks?

March 13, 2026

Sophisticated phishing attacks are bypassing on-device protections with troubling frequency, making it more critical than ever for users to protect themselves from potential threats, new research from Omdia shows.

Initial access techniques used by Iran-based threat actors

March 12, 2026

Analysis of attacks originating from Iran-linked threat groups reveals a preference for certain techniques Categories: Threat Research Tags: Iran, initial access

Feds say another DigitalMint negotiator ran ransomware attacks and extorted $75 million

March 12, 2026

A 41-year-old South Florida man is accused of conducting at least 10 ransomware attacks and extorting a combined $75.25 million in ransom payments while he was working as a ransomware negotiator for DigitalMint. Five of Angelo John Martino III’s alleged victims hired DigitalMint, which assigned Martino to conduct ransomware negotiations on their clients’ behalf —…

Researchers Uncover ‘LeakyLooker’ Vulnerabilities in Google Looker Studio

March 11, 2026

LeakyLooker flaws in Google Looker Studio let attackers run cross-tenant SQL attacks on cloud data

Chinese Nexus Actors Shift Focus to Qatar Amid Iranian Conflict

March 11, 2026

Two attacks on Qatari entities signal a shift in focus for China-backed actors and demonstrate how quickly they can pivot in response to geopolitical events.

Salesforce issues new security alert tied to third customer attack spree in six months

March 11, 2026

Threat hunters and a collection of unconfirmed victims are responding to a series of attacks targeting Salesforce customers, which the vendor disclosed in a security advisory Saturday. “Salesforce is actively monitoring threat activity targeting public-facing Experience Cloud sites, including attempts to take advantage of overly permissive guest user configurations,” the company said in the alert.…

FBI says even in an AI-powered world, security basics still matter

March 10, 2026

Artificial intelligence may be enhancing cyber threats, but the defensive approach to those AI-amplified attacks remains the same, a top FBI official said Tuesday. “We have seen actors both criminal and nation-state, they’re absolutely using AI to their advantage,” said Jason Bilnoski, deputy assistant director at the FBI’s cyber division. “But the way attacks unfold…

CISA: Recently patched Ivanti EPM flaw now actively exploited

March 10, 2026

CISA flagged a high-severity Ivanti Endpoint Manager (EPM) vulnerability as actively exploited in attacks and ordered U.S. federal agencies to patch systems within three weeks. […]

Teen crew caught selling DDoS attack tools

March 10, 2026

Seven minors who distributed online programs designed to facilitate DDoS attacks have been identified by Poland’s Central Bureau for Combating Cybercrime (CBZC). They were between 12 and 16 at the time of the crime. CBZC officer during a cybercrime investigation (Source: Poland’s Central Bureau for Combating Cybercrime) According to investigators, using the tools they administered,…

FBI alert: scammers target zoning permit applicants

March 9, 2026

The FBI warns of phishing attacks where crooks impersonate U.S. city and county officials to target people requesting planning and zoning permits. The FBI warns that scammers are impersonating U.S. city and county officials in phishing campaigns targeting businesses and individuals applying for planning or zoning permits. Using publicly available information, attackers craft messages that…

FBI warns of phishing attacks impersonating US city, county officials

March 9, 2026

The Federal Bureau of Investigation (FBI) warns that criminals are impersonating U.S. officials in phishing attacks targeting businesses and individuals who request city and county planning and zoning permits. […]

Cylake Offers AI-Native Security Without Relying on Cloud Services

March 6, 2026

Cylake’s platform will analyze security data locally and identify potential attacks for organizations concerned about data sovereignty.

Challenges and projects for the CISO in 2026

March 6, 2026

Sophisticated attacks and the incorporation of AI tools, talent shortages, and tight budgets are some of the challenges commonly cited when it comes to managing cybersecurity in organizations. In a changing environment, the key is no longer to stay one step ahead, but to maintain a resilient infrastructure that ensures a rapid response when —…

IRONSCALES Unveils AI Agents to Tackle ‘Phishing 3.0’

March 5, 2026

A new wave of phishing attacks is forcing security teams to rethink their defenses, and IRONSCALES believes AI agents are the answer. The Atlanta-based email security firm this week unveiled its Winter 2026 Release, introducing three specialized AI agents designed to help organizations counter what it calls “Phishing 3.0,” a new generation of AI-powered impersonation…

AI-powered attack kits go open source, and CyberStrikeAI may be just the beginning

March 3, 2026

AI is making it ever easier for bad actors to launch attacks, and a newly-identified open source platform, CyberStrikeAI, seems to be lowering the bar even further. The platform packages end-to-end attack automation into a single AI-native orchestration engine, and is linked to the threat actor behind the recent campaign that breached hundreds of Fortinet…

AI-powered attack kits go open source, and CyberStrikeAI may be just the beginning

March 3, 2026

SloppyLemming Targets Pakistan and Bangladesh Governments Using Dual Malware Chains

March 3, 2026

The threat activity cluster known as SloppyLemming has been attributed to a fresh set of attacks targeting government entities and critical infrastructure operators in Pakistan and Bangladesh. The activity, per Arctic Wolf, took place between January 2025 and January 2026. It involves the use of two distinct attack chains to deliver malware families tracked as…

How Deepfakes and Injection Attacks Are Breaking Identity Verification

March 2, 2026

Deepfakes and injection attacks are targeting identity verification moments, from onboarding to account recovery. Incode explains why enterprises must validate the full session—media, device integrity, and behavior—to stop synthetic and injected attacks in real time. […]

Steaelite RAT combines data theft and ransomware management capability in one tool

February 25, 2026

It’s bad enough that threat actors are leveraging AI for their attacks, but now they can also access a new remote access trojan (RAT) that makes it easy to launch data theft and ransomware attacks on Windows computers from a single management pane. The tool is called Steaelite, and according to researchers at BlackFog, it’s…

North Korean Lazarus Group Adopts Medusa Ransomware in Global Attacks

February 24, 2026

Lazarus Group is now using Medusa ransomware in attacks on healthcare and social services, signaling a move toward profit-focused cybercrime.

Modernizing TACACS+: Why Full-Session Encryption Matters More Than Ever

February 24, 2026

Protect your network from Salt Typhoon-style attacks. Learn how Cisco ISE 3.4 uses TACACS+ over TLS 1.3 and Duo MFA to provide full-session encryption.

Data Breaches in 2026: What’s old, what’s new?

February 23, 2026

Data breaches in 2026 explained, new cyber threats, AI driven attacks, common breach causes, and practical security strategies for individuals and businesses

Spitting Cash: ATM Jackpotting Attacks Surged in 2025

February 23, 2026

The attacks cost banks more than $20 million in losses last year, as criminals used many of the same tools and tactics they have wielded for more than a decade.

Iran’s MuddyWater Targets Orgs With Fresh Malware as Tensions Mount

February 23, 2026

The long-active Iranian threat group debuted various attack strains and payloads in attacks against organizations in the Middle East and Africa.

CISA: Recently patched RoundCube flaws now exploited in attacks

February 23, 2026

CISA flagged two Roundcube Webmail vulnerabilities as actively exploited in attacks and ordered U.S. federal agencies to patch them within three weeks. […]

Jackpotting Surge Costs Banks Over $20m, Warns FBI

February 23, 2026

A new FBI Flash alert claims $20m was lost to ATM jackpotting attacks in 2025 alone

Researchers Demonstrate 27 Attacks Against Major Password Managers

February 22, 2026

Researchers demonstrate multiple attacks against major password managers, showing how compromised servers and design flaws can expose encrypted vault data.

Best-in-Class ‘Starkiller’ Phishing Kit Bypasses MFA

February 19, 2026

A user-friendly PhaaS tool beats standard methods for detecting phishing attacks by live-proxying legitimate login sites.

Radware 2026 Global Threat Report Shows DDoS Attacks Jump 168% as Cyber Threats Escalate Across Networks and Applications

February 19, 2026

Primary driver of DDoS activity remains geopolitical and ideological conflict AI-Driven Bot Attacks Accelerate Worldwide

Poland Energy Survives Attack on Wind, Solar Infrastructure

February 17, 2026

Russia-aligned groups are probable culprits behind the wiper attacks against renewable energy farms, a manufacturer, and a heating and power plant.

Polish authorities arrest alleged Phobos ransomware affiliate

February 17, 2026

Polish officials arrested a 47-year-old man accused of participating in ransomware attacks as an affiliate for the Phobos ransomware group, the country’s Central Bureau for Combating Cybercrime said Tuesday. Authorities did not name the man who was arrested during a raid on his apartment in the Małopolskie province, but said he faces up to five…

Significant Rise in Ransomware Attacks Targeting Industrial Operations

February 17, 2026

Dragos annual report warns of a surge in ransomware attacks causing increased operational disruption in industrial environments

Webinar: How Modern SOC Teams Use AI and Context to Investigate Cloud Breaches Faster

February 17, 2026

Cloud attacks move fast — faster than most incident response teams. In data centers, investigations had time. Teams could collect disk images, review logs, and build timelines over days. In the cloud, infrastructure is short-lived. A compromised instance can disappear in minutes. Identities rotate. Logs expire. Evidence can vanish before analysis even begins. Cloud forensics…

Google patches first Chrome zero-day exploited in attacks this year

February 16, 2026

Google has released emergency updates to fix a high-severity Chrome vulnerability exploited in zero-day attacks, marking the first such security flaw patched since the start of the year. […]

New ClickFix attack abuses nslookup to retrieve PowerShell payload via DNS

February 15, 2026

Threat actors are now abusing DNS queries as part of ClickFix social engineering attacks to deliver malware, making this the first known use of DNS as a channel in these campaigns. […]

Google Ties Suspected Russian Actor to CANFAIL Malware Attacks on Ukrainian Orgs

February 13, 2026

A previously undocumented threat actor has been attributed to attacks targeting Ukrainian organizations with malware known as CANFAIL. Google Threat Intelligence Group (GTIG) described the hack group as possibly affiliated with Russian intelligence services. The threat actor is assessed to have targeted defense, military, government, and energy organizations within the Ukrainian regional and

Apple fixes zero-day flaw exploited in targeted attacks (CVE-2026-20700)

February 12, 2026

Apple has released fixes for a zero-day vulnerability (CVE-2026-20700) exploited in targeted attacks last year. CVE-2026-20700 is a memory corruption issue in dyld, the Dynamic Link Editor component of Apple’s operating systems, and may allow attackers with memory write capability to execute arbitrary code. “Apple is aware of a report that this issue may have…

North Korean Hackers Use Deepfake Video Calls to Target Crypto Firms

February 11, 2026

Campaign combines stolen Telegram accounts, fake Zoom calls and ClickFix attacks to deploy infostealer malware

That “summarize with AI” button might be manipulating you

February 11, 2026

Microsoft security researchers discovered a growing trend of AI memory poisoning attacks used for promotional purposes, referred to as AI Recommendation Poisoning. The MITRE ATLAS knowledge base classifies this behavior as AML.T0080: Memory Poisoning. The activity focuses on shaping future recommendations by inserting prompts that cause an assistant to treat specific companies, websites, or services…

OT Attacks Get Scary With ‘Living-off-the-Plant’ Techniques

February 10, 2026

Ironically, security by obscurity has helped prevent dangerous OT attacks in recent years. It won’t be that way forever.

New Cybercrime Group 0APT Accused of Faking Hundreds of Breach Claims

February 10, 2026

Researchers reveal the new 0APT cyber group is fabricating attacks on large organisations. Learn how they use fake data to trick companies into paying.

NCSC Issues Warning Over “Severe” Cyber-Attacks Targeting Critical National Infrastructure

February 10, 2026

NCSC call firms to ‘act now’ following disruptive malware attacks targeting Polish energy providers

Dutch agencies hit by Ivanti EPMM exploit exposing employee contact data

February 10, 2026

Dutch agencies confirmed attacks exploiting Ivanti EPMM flaws that exposed employee contact data at the data protection authority and courts. Dutch authorities said cyberattacks hit the Dutch Data Protection Authority and the Council for the Judiciary after hackers exploited newly disclosed flaws in Ivanti Endpoint Manager Mobile (EPMM). The incidents were reported to parliament, and…

New tool blocks imposter attacks disguised as safe commands

February 8, 2026

A new open-source and cross-platform tool called Tirith can detect homoglyph attacks over command-line environments by analyzing URLs in typed commands and stopping their execution. […]

Shai-hulud: The Hidden Cost of Supply Chain Attacks

February 6, 2026

Recent supply chain attacks involving self-propagating worms have spread far, but the damage and long-term impact is hard to quantify.

EDR, Email, and SASE Miss This Entire Class of Browser Attacks

February 6, 2026

Many modern attacks happen entirely inside the browser, leaving little evidence for traditional security tools. Keep Aware shows why EDR, email, and SASE miss browser-only attacks and how visibility changes prevention. […]

New Hacking Campaign Exploits Microsoft Windows WinRAR Vulnerability

February 5, 2026

Researchers at Check Point link ‘Amarath-Dragon’ attacks to prolific Chinese cyber-espionage operation