Marquis disclosed that a ransomware gang stole data for 672,075 individuals in an August 14, 2025 breach that disrupted operations at 74 U.S. banks after attackers compromised a SonicWall firewall. The stolen information included names, dates of birth, addresses, phone numbers, Social Security and Taxpayer Identification numbers, and financial account details, and Marquis has filed a lawsuit against SonicWall while defending multiple class action suits. #Marquis #SonicWall
Category: Cyber Security News
The Interlock ransomware gang exploited a maximum-severity remote code execution vulnerability (CVE-2026-20131) in Cisco Secure Firewall Management Center as a zero-day beginning January 26, 2026, enabling unauthenticated remote Java code execution as root on unpatched devices. Cisco patched the flaw on March 4 after Amazon threat intelligence found Interlock had been exploiting the vulnerability for 36 days, and Interlock — linked to ClickFix — has also deployed NodeSnake and a new AI-era strain called Slopoly while claiming attacks on DaVita, Kettering Health, the Texas Tech University System, and the city of Saint Paul. #Interlock #CiscoSecureFMC
ConnectWise has warned that ScreenConnect versions before 26.1 contain a critical cryptographic signature verification vulnerability (CVE-2026-3564) that can expose ASP.NET machine keys and enable unauthorized session authentication and privilege escalation. The vendor patched the issue in ScreenConnect 26.1—cloud instances were auto-upgraded, but on‑premises administrators must update and follow hardening guidance immediately. #ScreenConnect #ConnectWise #CVE-2026-3564 #ASPNetMachineKey
Identity protection firm Aura disclosed that a voice phishing attack on an employee led to unauthorized access to nearly 900,000 records containing customer names and email addresses, including about 20,000 current and 15,000 former customers. Threat group ShinyHunters claimed responsibility and leaked files on their extortion site, while Aura says SSNs, passwords, and financial data were not exposed and it is investigating with external experts and law enforcement. #Aura #ShinyHunters
The U.S. Treasury’s OFAC sanctioned six individuals and two entities for operating a DPRK IT worker scheme that defrauds U.S. businesses and funnels illicit revenue to fund North Korea’s WMD programs. The operation uses fake identities, AI-enabled persona fabrication, VPNs like Astrill, and malware-driven extortion to gain sustained access to companies…
Tulsi Gabbard defended omitting foreign election interference from the latest annual threat assessment and justified her presence during an FBI raid on a Georgia election office as an observer at the president’s request. Lawmakers raised alarms about potential foreign influence, cuts to CISA, the lack of key appointments, and mention of…
Senator Markwayne Mullin, President Trump’s nominee for DHS secretary, declined during a Senate Homeland Security hearing to commit to restoring CISA’s workforce or reversing budget cuts enacted under outgoing secretary Kristi Noem. Lawmakers warned that reductions at CISA could weaken U.S. defenses ahead of potential cyberattacks tied to recent tensions with…
A likely Russia-linked actor deployed a sophisticated iPhone hacking tool called DarkSword to target Ukrainian users via compromised websites, enabling rapid theft of sensitive data with little to no user interaction. The hit-and-run campaign attributed to UNC6353 exfiltrated emails, messages, photos, credentials and cryptocurrency wallet data before deleting itself, and Apple…
By 2026 the predictive window has collapsed: attackers weaponize high‑risk vulnerabilities and exploit them within days, outrunning traditional prediction-and-patch cycles. Defenders must adopt preemptive security—reducing attacker conditions through exposure management, stronger hygiene, credential controls, and AI‑augmented workflows to limit blast radius and respond with full context. #Rapid7 #Infostealers…
CISA has ordered federal agencies to secure Zimbra Collaboration Suite servers after active exploitation of a stored XSS vulnerability (CVE-2025-66376) that can be abused via CSS @import in HTML emails to execute arbitrary JavaScript. The agency added the flaw to its catalog of vulnerabilities exploited in the wild and gave FCEB agencies until April 1 under BOD 22-01 to patch or apply mitigations, while warning all organizations to update or discontinue the product if mitigations are unavailable. #Zimbra #CVE-2025-66376 #CVE-2025-27915 #Synacor #WinterVivern
A top U.S. cybersecurity official said the government has not seen an increase in cyber threats from Iran since U.S. and Israeli strikes began, and CISA remains closely coordinated with industry and sector groups. CISA is working with Stryker after the March 11 Handala attack and is focused on addressing the…
A cyberattack on bank vendor Marquis Software exposed personal and financial information for 672,075 people, with investigators saying hackers copied files from the vendor’s systems after a breach discovered on August 14. Although Marquis initially identified 74 affected financial institutions, aggregated state filings and third-party analyses put the likely victim count…
Researchers disclosed DarkSword, a sophisticated JavaScript-based iOS exploit kit that enables full device compromise with minimal user interaction and has been used by the Russian state-sponsored group UNC6353 in attacks against Ukraine and later by commercial surveillance vendors. The exploit chain leverages multiple iOS flaws to deploy information-stealers like GhostBlade, GhostKnife,…
Cloud security startup Native emerged from stealth with $42 million in funding to help enterprises enforce security policies consistently across multi-cloud environments. The $31M Series A led by Ballistic Ventures brought Phil Venables onto the board, and Native’s platform converts policy intent into provider-specific controls for AWS, Azure, Google Cloud, and…
Autonomous offensive security company XBOW raised $120 million in a Series C round to scale its AI-driven platform that discovers and validates software vulnerabilities autonomously. The funding, led by DFJ Growth and Northzone and valuing XBOW at over $1 billion, will accelerate product innovation, international expansion, and efforts to keep defenders…