News Archive
2287 stories · page 89 of 96Every story we've published, newest first. Vulnerability records live in the CVE Tracker.
FortiBleed Actors Collaborating With Inc, Lynx Ransomware Gangs
Threat actors who previously compromised numerous Fortinet firewalls are now reportedly collaborating with ransomware groups, including those behind the INC and LYNX ransomware strains. This collaboration appears to be a strategy to monetize the initial access gained through exploiting vulnerabilities in Fortinet devices.
Google Disrupts NetNut Residential Proxy Network Spanning 2 Million Home Devices
Google's Threat Intelligence Group (GTIG), in collaboration with the FBI and Lumen, has taken significant action to disrupt NetNut, a large-scale residential proxy network. The operation has reportedly degraded the network, which leverages approximately two million home devices as relays for internet traffic.
Ransomware Groups Turn to Citrix Bleed 2, BYOVD, and Supply Chain Credentials
Threat actors are increasingly leveraging a combination of sophisticated techniques, including the exploitation of a critical Citrix vulnerability, Bring Your Own Vulnerable Driver (BYOVD) attacks, and the misuse of compromised supply chain credentials, to gain initial access for ransomware operations.
Ransomware Thugs Masquerade as Interpol to Entice Small Biz
A widespread ransomware operation is targeting businesses globally, employing deceptive tactics to trick victims into downloading malicious files. The campaign, which has been observed across various regions including the United States, Europe, and the Middle East, leverages social engineering to achieve its aims.
Catan and Mouse
Cisco Talos is alerting organizations to a sophisticated phishing-as-a-service (PhaaS) platform known as ARToken. This platform shares significant infrastructure and operational patterns with the previously documented EvilTokens platform, indicating a mature and evolving threat. ARToken offers a comprehensive suite of tools designed to facilitate advanced phishing and business email compromise…
The Gentlemen ransomware: what you need to know
A ransomware operation known as "The Gentlemen" has emerged, characterized by its aggressive tactics despite its seemingly courteous moniker. Details regarding the group's operations and motivations are still being analyzed, but initial observations suggest a significant threat to potential targets.
Improving security posture across the Microsoft partner ecosystem
Microsoft is implementing a new strategy to bolster security across its extensive partner ecosystem, with a particular emphasis on Cloud Solution Providers (CSPs). These partners play a vital role in the deployment and ongoing management of Microsoft's cloud services, including Azure and Microsoft 365. The company's initiative aims to ensure the partner network maintains a high standard of…
ThreatsDay: AI Compute Hijacking, Apple Email Flaw, BlueHammer Ransomware + 14 Stories
This week's security landscape highlights vulnerabilities across a range of technologies, from web browsers and botnets to artificial intelligence systems and email infrastructure. Researchers have identified exploitable gaps in these diverse areas, underscoring a persistent theme of unexpected weaknesses being discovered through diligent testing.
Formalizing Red Teaming Offensive Methodology as a Multi-Agent AI Architecture
Threat actors are increasingly leveraging artificial intelligence to accelerate their offensive operations, from reconnaissance and vulnerability discovery to social engineering. In response, Rapid7's Red Team has developed a formalized, multi-agent AI system designed to mirror their end-to-end penetration testing methodology. This production system, built over the past year, aims to automate…
ToddyCat-Linked Umbrij Malware Abuses OAuth to Access Gmail via Google API
A newly identified malware strain, dubbed Umbrij, is being employed by the threat actor group ToddyCat to gain unauthorized access to Gmail accounts. This malware leverages the Google API to achieve its objectives, potentially compromising sensitive email communications.
Context Engineering | Compaction & Agent Memory for Automated Malware Analysis
SentinelLABS has conducted an evaluation of OpenAI's context compaction feature, a technique designed to manage and compress the history of interactions for long-running agent tasks. This pattern aims to reduce the volume of input tokens, thereby lowering costs and minimizing noise in the data processed by AI models, without sacrificing the quality of the output. The study focused on applying…
Anthropic's AI Finds Bugs. IBM Bets $5B It Can Fix Them.
IBM has launched a significant initiative, codenamed Project Lightwell, involving 20,000 engineers from IBM and Red Hat. This effort is reportedly a response to concerns surrounding the security of the open-source software supply chain, amplified by findings from Anthropic's AI model, Mythos.
Identity Lifecycle Management Wasn't Built for AI Agents
The traditional approach to managing digital identities, known as identity lifecycle management, is ill-equipped to handle the growing presence of artificial intelligence agents within enterprise systems. These systems were originally designed to track human employees, with lifecycles defined by hiring, management, and termination processes. AI agents, however, do not fit this model.
Cybersecurity Mission Creep in the US
A growing trend in the United States involves policymakers increasingly framing a wide range of societal problems as cybersecurity issues, a phenomenon described as "cybersecuritization." This reframing transforms diverse policy challenges, including misinformation, social media safety for children, antitrust regulations, allegations of journalist misconduct, and anti-sex trafficking laws,…
AI Agent Exploits Langflow RCE to Automate Database Ransomware Attack
A cybersecurity firm has identified what it believes to be the first instance of an artificial intelligence agent autonomously executing a complete ransomware attack. Researchers at Sysdig's Threat Research Team have dubbed the AI operator "JADEPUFFER."
Missed incidents, persistent threats, and response gaps: Insights from compromise assessment projects
Kaspersky's analysis of its 2025 compromise assessment engagements reveals a significant number of undetected threats, with many persisting for months or even years. These assessments, which examine networks for signs of compromise, found that a substantial portion of incidents were missed by existing security tools and processes.
FortiBleed Credential Theft Linked to INC and Lynx Ransomware Operations
A financially motivated cyber campaign dubbed "FortiBleed" has been linked to the INC and Lynx ransomware operations, suggesting that the credentials stolen through this activity were intended for subsequent network intrusions. This discovery highlights a coordinated effort where the initial compromise is leveraged to facilitate further malicious activities.
New ChocoPoC RAT Targets Vulnerability Researchers via Fake PoC Exploit Repos
A new Remote Access Trojan (RAT) named ChocoPoC is being distributed through deceptive proof-of-concept (PoC) exploit repositories on GitHub, specifically targeting vulnerability researchers. These malicious repositories masquerade as legitimate sources for code demonstrating newly discovered vulnerabilities, aiming to trick security professionals into downloading and executing the malware.
Inside Elastic InfoSec's agentic SOC: cutting alert triage from 30 minutes to under 3
Elastic's security team has developed an "agentic" Security Operations Center (SOC) that automates alert investigation, significantly reducing the time it takes to triage security alerts. This new system can process alerts in under three minutes, a drastic improvement from the previous 30-minute manual triage time. The approach leverages Elastic's native technology stack, including Elastic…
Smashing Security podcast #474: Polymarket can predict the future. So how did it miss this hack?
A decentralized prediction market platform, Polymarket, recently experienced a security incident, highlighting a significant failure to anticipate its own vulnerability despite its business model revolving around predicting future events. This incident was discussed on the Smashing Security podcast, episode 474, featuring cybersecurity expert Graham Cluley and special guest Quentyn Taylor, who…
Crafty Phishing Campaigns Auto-Adapt to Victim's Device, OS
Cybercriminals are employing sophisticated phishing techniques that automatically adapt to a victim's device and operating system, a tactic designed to significantly boost the success rate of their malicious campaigns. This adaptive approach allows attackers to tailor their attacks, delivering payloads specifically engineered for the target's environment, thereby increasing the likelihood of a…
And the Winner in Dominant Malware Delivery? ClickFix
A sophisticated social engineering tactic, previously considered an outlier, has become a prevalent method for delivering malware, according to security researchers. This technique, which leverages user interaction to facilitate malicious payloads, is now frequently employed in cyberattacks.
Microsoft named a leader in the Frost Radar for cloud and application runtime security
Microsoft has been recognized as a leader in the cloud and application runtime security market by Frost & Sullivan. The research firm's latest Frost Radar report places Microsoft at the forefront of this rapidly evolving security domain.
When Too Much Security Data Becomes the Risk
A chief information security officer has leveraged artificial intelligence to address a growing challenge: the sheer volume of data generated by security tools, particularly firewall logs, has become a significant liability for both security operations and organizational budgets. This deluge of information, while intended to enhance security posture, has in many cases overwhelmed security…