Showing 49–72 of 305 reports
DragonForce TURN and MQTT Backdoors Show Why Ransomware Defense Needs Egress Visibility
Lab52 reports DragonForce-linked backdoors abusing TURN relays and MQTT for resilient command-and-control. Here is what SMBs and government contractors should monitor now.
TA419 Shows AI Policy Is Now an Espionage Phishing Target
Proofpoint reports China-aligned TA419 is targeting U.S. AI policy experts with identity impersonation and adversary-in-the-middle phishing. Here is what SMBs, law firms, universities, and government contractors should take from it.
AI Is Turning Vulnerability Triage Into a Threat-Intel Problem
Google Threat Intelligence Group says AI is increasing vulnerability discovery and n-day weaponization pressure. For SMBs and government contractors, the answer is not panic-patching everything—it is exposure-aware, intelligence-led triage.
2CLoader Shows Why Malware Loader Alerts Need Identity Response
Zscaler ThreatLabz detailed 2CLoader delivering Vidar, Remus, and XWorm. Here is why SMB and government-contractor defenders should treat loader detections as credential and identity incidents.
Zimbra CVE-2026-73570 Shows Mail Servers Need Full Incident Review
Microsoft tracked exploitation of an unauthenticated Zimbra command injection flaw. For defenders, this is a patch-and-investigate mail-server incident, not just a routine update.
RMM Phishing Turns Trusted Admin Tools Into Persistent Access
Microsoft observed phishing campaigns abusing legitimate MSP360 RMM and ScreenConnect to create redundant remote access. Here is what SMB and government-contractor defenders should monitor.
Apache MINA SSHD Auth Bypasses Show Why Embedded SSH Needs Inventory
Apache disclosed critical MINA SSHD authentication-bypass flaws affecting certain Java SSH server implementations. Here is what SMB and government-contractor defenders should check first.
Custom GPT ClickFix Shows Why AI Trust Needs Browser-to-Shell Controls
Attackers abused ChatGPT Custom GPT pages and fake verification prompts to push victims into a ClickFix-to-RAT chain. Here is what SMB and government-contractor defenders should monitor.
NetScaler Zero-Days Show Why Edge Devices Need Incident Response, Not Just Patching
Unit 42 reports active exploitation of Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772. Here is what SMBs and government contractors should do now.
NeedyMantis Shows Why Post-Compromise Malware Needs Full Intrusion Review
Microsoft’s NeedyMantis analysis shows why targeted malware found after initial access should trigger full intrusion review, not a simple cleanup ticket.
Python MaaS Infostealer Builder Shows Why Credential Theft Needs Behavior Controls
K7 Labs’ Python MaaS infostealer-builder research shows why defenders need behavior controls for credential theft, webhook exfiltration, persistence, and session compromise.
MacSync Shows Why macOS Stealers Need Full Endpoint Response
Kaspersky’s MacSync research shows why SMB and government-contractor defenders should treat macOS infostealers as full intrusion risk, not simple nuisance malware.
NetScaler KEV RCEs Show Why Edge Devices Need Emergency Playbooks
Citrix and CISA confirmed active exploitation of two critical NetScaler ADC/Gateway flaws. Here is how SMB and government-contractor defenders should patch, verify exposure, and hunt for compromise.
PeopleSoft WAF Bypass Shows Why Patch-First Beats Perimeter Rules
GTIG/Mandiant report renewed PeopleSoft exploitation using encoded-path WAF bypasses. Here is what defenders should validate beyond perimeter string matching.
Storm-3168 Shows Why Service Principals Are Cloud Ransomware Risk
Microsoft’s Storm-3168 reporting shows how compromised Azure service principals can drive fast cloud destruction, credential collection, and recovery sabotage. Here is what SMB and government-contractor defenders should tighten first.
Lunex Stealer Shows BYOVD Is Moving Into Credential Theft
Lunex/Psychedelic Stealer uses BYOVD tradecraft to blind endpoint security before stealing browser credentials, cookies, and wallet data. Here is what SMB and government-contractor defenders should prioritize.
Storm-2570 Shows Why Ransomware Defense Should Track Tradecraft, Not Payloads
Microsoft’s Storm-2570 reporting shows why defenders should track ransomware affiliate behavior: RMM abuse, tunnels, credential theft, lateral movement, security tampering, and cloud exfiltration before encryption.
UTA0565 Shows Why Browser Zero-Days Need Endpoint Correlation
Volexity reporting on UTA0565 shows how fake websites, Chrome zero-days, Windows privilege escalation, and CLEANGULP malware turn normal browsing into endpoint compromise. Here are practical controls for SMBs and government contractors.
ClickFix Shows Why Brand Impersonation Needs Workflow-Based Defense
Recorded Future’s ClickFix research shows how trusted logos and verification prompts can turn users into the delivery mechanism. Here is how SMBs and government contractors should defend the workflow, not just the payload.
Malicious Terraform Providers Show Why IaC Needs Supply-Chain Controls
Aikido found Graphalgo-linked Go malware in Terraform providers and Go modules. The defensive lesson is that infrastructure-as-code dependencies need the same scrutiny as application packages, because they often execute near production credentials.
RemControl Shows Why Mobile Banking Fraud Needs App-Control Guardrails
Group-IB reported RemControl, a new Android banking trojan that combines fake app pages, Accessibility Service abuse, banking overlays, remote control, and AI-assisted criminal infrastructure. The defensive lesson: mobile devices that approve access or payments need app-control guardrails and incident playbooks.
EvilTokens Shows Why Device Code Phishing Needs Identity Controls
Microsoft says EvilTokens helped compromise more than 12,000 inboxes by abusing device code authentication. Here is what SMBs and government contractors should lock down now.
TeamFiltration Shows Why Forgotten Service Accounts Are Cloud Identity Risk
Proofpoint tracked a TeamFiltration-style Microsoft 365 password-spraying campaign where every confirmed compromise involved unmanaged service accounts. The defensive lesson: non-human identities need ownership, rotation, conditional access, and behavior monitoring.
CLOSEDQUORUM Shows Why AI C2 Needs Behavior-Based Detection
Cisco Talos documented CLOSEDQUORUM, an AI-assisted implant that uses multiple LLM providers to choose its next action. The defensive answer is correlation, not simple domain blocking.