Showing 25–48 of 173 reports
RemControl Shows Why Mobile Banking Fraud Needs App-Control Guardrails
Group-IB reported RemControl, a new Android banking trojan that combines fake app pages, Accessibility Service abuse, banking overlays, remote control, and AI-assisted criminal infrastructure. The defensive lesson: mobile devices that approve access or payments need app-control guardrails and incident playbooks.
CLOSEDQUORUM Shows Why AI C2 Needs Behavior-Based Detection
Cisco Talos documented CLOSEDQUORUM, an AI-assisted implant that uses multiple LLM providers to choose its next action. The defensive answer is correlation, not simple domain blocking.
PAYLOAD Ransomware Shows Why Group Policy Is a Tier-0 Attack Surface
Kaspersky reported a PAYLOAD ransomware incident where attackers abused Active Directory Group Policy to disrupt domain-joined Windows systems without deploying a Windows encryptor. The lesson for SMBs and government contractors: Group Policy needs Tier-0 monitoring, change control, and recovery planning.
Fake GitHub Repos Show Why Software Downloads Need Trust Verification
A Rapuncel infostealer campaign abused fake GitHub software repositories, oversized archives, DLL sideloading, and a signed kernel driver to suppress defenses and steal credentials.
WaterPlum Shows Why Developer Hiring Needs Malware-Resistant Guardrails
North Korea-linked WaterPlum/Contagious Interview shows why developer hiring, coding tests, contractor onboarding, and workstation isolation need to be treated as one security workflow.
Cyclops Blink on Cisco FMC Shows Why Edge Appliances Need Compromise Review
Sophos CTU and Cisco Talos reporting on Cyclops Blink activity against Cisco Secure FMC shows why edge security appliances need compromise review, not just emergency patching.
SloppyRAT Shows Why Ransomware Defense Has to Watch the Whole Infection Funnel
Zscaler ThreatLabz analysis of SloppyRAT shows why defenders need to detect the full ransomware precursor funnel, not just the final payload.
THost9 Shows Why Exposed Android Debug Interfaces Need Compromise Review
Dark Atlas research on THost9 shows how exposed ADB and Redroid debug services can become a malware propagation path. Here is what SMB and government-contractor defenders should review now.
OfferLoader Shows Why Commodity Malware Needs Funnel-Aware Defense
Unit 42 exposed a pay-per-install operation using YouTube gaming lures and SEO poisoning. The lesson: suspicious installers need full compromise review, not quick cleanup.
Fileless PHP Rootkit Shows Why BIG-IP Incidents Need Process-Level Hunting
SophosLabs analysis of a BIG-IP APM-linked PHP web server rootkit shows why defenders need post-patch compromise review, process-level hunting, and edge appliance rebuild discipline.
Teams Helpdesk Impersonation Shows Why Remote Support Needs Guardrails
Microsoft’s Teams helpdesk impersonation case shows why remote support sessions need verification, tool control, user-writable execution limits, and WinRM monitoring.
Toy Ghouls Shows Why Custom C2 Needs Protocol-Aware Monitoring
Kaspersky reports that Toy Ghouls has added custom Windows backdoors using HiveMQ MQTT and Matrix/Element-style command channels. For SMBs and government contractors, the lesson is not just malware blocking — it is protocol-aware egress control, service persistence review, and post-compromise valida
Ted Backdoor Shows Why Edge Load Balancers Need Compromise Review
Rapid7’s DPRK-attributed ted backdoor and curlRAT research shows why HAProxy, SSH, cron, and other Linux edge services need integrity checks, centralized logs, and post-compromise review.
Fake Claude Opus 5 App Shows Why AI Tooling Needs Software Control
A fake Claude Opus 5 GitHub desktop app delivering RevStealer shows why AI experimentation needs approved software paths, endpoint controls, and credential-theft triage.
NodeRabbit and PollCat Show Why Developer Workstations Need Recruiting-Lure Controls
Mirage Kitten’s NodeRabbit and PollCat malware campaigns show why fake recruiter coding tests are a practical workstation, credential, and supply-chain risk for SMBs and government contractors.
JSCeal Shows Why Compiled Script Malware Needs Bytecode-Aware Defense
Check Point’s JSCeal research shows how compiled V8 bytecode can hide credential theft, browser theft, and local traffic interception from normal JavaScript inspection workflows.
TerminalFix Shows Why Fake CAPTCHA Lures Are Network Access Problems
Microsoft’s TerminalFix campaign turns fake CAPTCHA social engineering into DLL sideloading, persistence, Active Directory reconnaissance, and reverse-tunnel access. The lesson for SMBs and government contractors: compromised workstations can become internal proxy nodes.
PackClient Shows Why Phishing Defense Needs Execution Controls
Proofpoint reported TA4922 using PackClient in tax-themed phishing campaigns. The defensive lesson for SMBs and government contractors is to control the execution chain after the click.
Signed ClickOnce Lures Show Why Hiring Workflows Need Endpoint Guardrails
A fake Web3 interview chain used signed ClickOnce delivery to deploy credential stealers and a Go hVNC RAT. Here is what SMBs and government contractors should tighten now.
AI-Enabled Malware Still Behaves Like Malware
Unit 42’s telemetry shows most AI-enabled malware remains experimental, but the real risk is faster iteration and AI-branded delivery. Defenders still win by watching behavior, identity, signing, and execution.
BTR.sys Shows Why Trusted Security Drivers Need Behavioral Monitoring
Check Point Research shows how Microsoft Defender’s boot-time remediation driver can be repurposed for privileged file and registry operations. The defensive lesson is simple: monitor trusted security components by behavior, not signature alone.
WeedHack Shows SEO Poisoning Is Malware Delivery Infrastructure
McAfee says WeedHack is still using fake gaming sites, SEO poisoning, Discord links, MediaFire, and GitHub-style trust signals to deliver malware. The same playbook can hit business users searching for tools and downloads.
Fake AI Tools Show Brand Trust Has Become Malware Delivery
Sophos X-Ops found attackers repeatedly impersonating AI brands with fake installers, malicious extensions, phishing lures, and AI-assisted tooling. The near-term defense is not exotic: approved sources, browser governance, endpoint telemetry, DNS controls, token hygiene, and clear AI software rules.
StopAndProtect Shows Why WordPress Sites Are Attack Infrastructure
Check Point Research exposed StopAndProtect, an operation abusing thousands of compromised WordPress sites for ClickFix delivery, malware staging, command routing, victim logging, data theft, and ransomware. The practical lesson: public websites need the same ownership, telemetry, and incident-response discipline as other production infrastructure.