Showing 97–120 of 401 reports
Malicious Terraform Providers Show Why IaC Needs Supply-Chain Controls
Aikido found Graphalgo-linked Go malware in Terraform providers and Go modules. The defensive lesson is that infrastructure-as-code dependencies need the same scrutiny as application packages, because they often execute near production credentials.
RemControl Shows Why Mobile Banking Fraud Needs App-Control Guardrails
Group-IB reported RemControl, a new Android banking trojan that combines fake app pages, Accessibility Service abuse, banking overlays, remote control, and AI-assisted criminal infrastructure. The defensive lesson: mobile devices that approve access or payments need app-control guardrails and incident playbooks.
EvilTokens Shows Why Device Code Phishing Needs Identity Controls
Microsoft says EvilTokens helped compromise more than 12,000 inboxes by abusing device code authentication. Here is what SMBs and government contractors should lock down now.
TeamFiltration Shows Why Forgotten Service Accounts Are Cloud Identity Risk
Proofpoint tracked a TeamFiltration-style Microsoft 365 password-spraying campaign where every confirmed compromise involved unmanaged service accounts. The defensive lesson: non-human identities need ownership, rotation, conditional access, and behavior monitoring.
CLOSEDQUORUM Shows Why AI C2 Needs Behavior-Based Detection
Cisco Talos documented CLOSEDQUORUM, an AI-assisted implant that uses multiple LLM providers to choose its next action. The defensive answer is correlation, not simple domain blocking.
M-26-15 Makes PQC Migration a Contractor Readiness Issue
OMB Memorandum M-26-15 turns post-quantum cryptography migration into a planning, inventory, procurement, and contractor-readiness problem. Federal agencies and vendors should start with cryptographic inventories, TLS 1.3 milestones, crypto-agile architecture, and contract language now.
Exposed AWS Keys Show Why Secret Scanning Needs Incident Runbooks
Unit 42 analyzed how AWS quarantines publicly exposed IAM access keys after GitHub secret-scanning detections. For SMBs and government contractors, the lesson is clear: provider automation helps, but cloud teams still need logging, rotation, and incident runbooks for leaked secrets.
PAYLOAD Ransomware Shows Why Group Policy Is a Tier-0 Attack Surface
Kaspersky reported a PAYLOAD ransomware incident where attackers abused Active Directory Group Policy to disrupt domain-joined Windows systems without deploying a Windows encryptor. The lesson for SMBs and government contractors: Group Policy needs Tier-0 monitoring, change control, and recovery planning.
Orkes Conductor RCE Shows Why Workflow APIs Need Hard Network Boundaries
Attackers are actively targeting Orkes Conductor deployments vulnerable to CVE-2026-58138, an unauthenticated remote code execution flaw in workflow script evaluators. The practical lesson: workflow APIs and automation control planes need patching, segmentation, and tight exposure control.
Linux Kernel LPE Quartet Shows Why Patch Validation Matters
Four Linux kernel local-root vulnerabilities show why defenders need kernel patch validation, container-host prioritization, and attack-surface reduction—not just initial-access monitoring.
Gyazo Breach Shows Why Screenshot Tools Need Data-Loss Controls
Gyazo disclosed unauthorized access affecting 23.62 million user records and roughly 490 million image metadata records. The lesson for SMBs and government contractors is simple: screenshot and screen-recording tools are data stores, not harmless utilities.
Fake GitHub Repos Show Why Software Downloads Need Trust Verification
A Rapuncel infostealer campaign abused fake GitHub software repositories, oversized archives, DLL sideloading, and a signed kernel driver to suppress defenses and steal credentials.
WaterPlum Shows Why Developer Hiring Needs Malware-Resistant Guardrails
North Korea-linked WaterPlum/Contagious Interview shows why developer hiring, coding tests, contractor onboarding, and workstation isolation need to be treated as one security workflow.
BragJack Shows Why AI Browser Agents Need Extension Controls
BragJack demonstrates how malicious extensions can hijack AI browser agents, turning browser add-ons into a higher-impact endpoint risk. Here are the practical controls SMBs and government contractors should prioritize.
Honeywell Settlement Shows NIST 800-171 Is a Billing Risk
DOJ’s Honeywell Aerospace settlement is a reminder that NIST 800-171 gaps can create False Claims Act exposure for defense contractors even without a public breach.
Passkey Phishing Shows Why Microsoft 365 Needs Enrollment Guardrails
Microsoft is tracking passkey-themed social engineering that turns MFA enrollment trust into Microsoft 365 cloud compromise. Here is what SMBs and government contractors should monitor and lock down.
Cyclops Blink on Cisco FMC Shows Why Edge Appliances Need Compromise Review
Sophos CTU and Cisco Talos reporting on Cyclops Blink activity against Cisco Secure FMC shows why edge security appliances need compromise review, not just emergency patching.
Revolut Breach Shows Why Data Requests Need Verification Controls
Revolut confirmed sensitive customer data was disclosed after fraudulent requests appeared to come from a legitimate government agency email domain. Here is what SMBs and government contractors should tighten now.
Check Point VPN Flaws Show Why Remote Access Needs Emergency Patch Discipline
Dutch NCSC warns exploitation is expected soon for two critical Check Point VPN RCE flaws. Here is what SMBs and government contractors should patch, restrict, and review now.
Mirth Connect Flaws Show Why Healthcare Middleware Needs Compromise Review
CISA warned that NextGen Mirth Connect SQL injection and XXE flaws can expose data or disrupt healthcare integration workflows. Here is how SMBs, healthcare vendors, and government contractors should respond.
AI Invoice Fraud Shows Why Finance Needs Verification Controls
Microsoft observed a million-email AI-assisted executive impersonation campaign pushing fabricated invoices and ACH payment requests. For SMBs and government contractors, the fix is not just better spam filtering — it is finance workflow verification.
Angular SSR Flaws Show Why Hydration and Edge Caches Need Security Review
New Angular SSR advisories show how hydration, transfer-state caching, URL normalization, and server-side credentials can become application security boundaries.
SloppyRAT Shows Why Ransomware Defense Has to Watch the Whole Infection Funnel
Zscaler ThreatLabz analysis of SloppyRAT shows why defenders need to detect the full ransomware precursor funnel, not just the final payload.
Cloud Web Apps Need Attack-Path Defense, Not Just App Scans
Microsoft’s cloud web applications threat matrix is a useful reminder: modern web app risk spans code, CI/CD, managed identities, serverless triggers, storage, and logs.