Vulnerabilities

As part of Operation Sentinel, more than 6,000 malicious links were taken down and the six ransomware variants were decrypted.  ​ Read More  ​ 

The attackers used the built-in Windows BitLocker security feature to lock files on compromised systems.  ​ Read More  ​ 

Raccoon0365 was responsible for at least 5,000 compromised Microsoft 365 accounts across 94 countries.  ​ Read More  ​ 

The attacks involve both financially motivated cybercriminal groups, such as TA2723, and state-backed threat actors.  ​ Read More  ​ 

Stryzhak gained access to the Nefilim ransomware platform in June 2021 in exchange for 20 percent of any ransom proceeds.  ​ Read More  ​ 

In brief: SonicWall, Sisco, WatchGuard patch actively exploited zero-days, the Clop extortion group targets CentreStack file servers, and more.  ​ Read More  ​ 

The probe was launched after French authorities received intelligence from Italy indicating that the ferry’s IT system had been infected with a RAT.  ​ Read More  ​ 

Attacks involving Cisco SEG and SEWM appliances have been attributed to a suspected Chinese threat group known as UAT-9686.  ​ Read More  ​ 

The campaign involves at least 17 compromised Firefox extensions that use steganography to conceal a JavaScript loader within PNG logo files.  ​ Read More  ​ 

Scammers allegedly tricked victims into installing remote access software, allowing criminals to steal online banking credentials.  ​ Read More  ​ 

The extension includes scripts designed to capture conversations across major platforms such as ChatGPT, Claude,  and Gemini.  ​ Read More  ​ 

The attack starts with the attackers gaining initial access via ViewState deserialization or ToolShell-based exploits, then deploy ShadowPad on the compromised server.  ​ Read More  ​ 

BlackForce is designed to steal user credentials and conduct Man-in-the-Browser (MitB) attacks.  ​ Read More  ​ 

Attackers are abusing the flaw to achieve remote code execution in applications using React Server Components.  ​ Read More  ​ 

Arctic Wolf said it observed active intrusions involving malicious single sign-on (SSO) logins on December 12.  ​ Read More  ​