Stateful detections are emerging as a critical control for cloud-native runtime security because attacks such as React2Shell and AI-assisted intrusions can escalate from vulnerability disclosure to compromise in minutes. The article also highlights the rise of JADEPUFFER, widespread adoption of stateful detections, and the growing need for trusted automated response to keep pace with agentic threat actors. #React2Shell #JADEPUFFER #Sysdig
Silver Fox is distributing ValleyRAT through a signed Chinese adware app, using DLL sideloading and trusted processes to evade security controls. Kaspersky linked the campaign to QN Wallpaper abuse, noted serious post-infection capabilities, and urged users and organizations to avoid questionable software and security exclusions. #SilverFox #ValleyRAT #QNWallpaper #Winos40 #Kaspersky…
This week’s cybersecurity roundup shows how trusted systems, familiar prompts, and weak defaults were repeatedly abused to enable espionage, credential theft, ransomware, and backdoor access. From Fire Ant and PlayCrypt to ValleyRAT, Ghost Penal, and malicious ZBT routers, the common theme was attackers turning ordinary infrastructure and user trust into reliable…
DPRK-linked threat actors are expanding their “IT worker” scheme into sales, marketing, healthcare, and finance by using synthetic identities, forged documents, VPNs, proxy services, and AI tools to secure remote jobs at targeted organizations. Investigations also show use of laptop farms, PiKVM, and related infrastructure to maintain access, helping fund North…
Socket’s Threat Research Team uncovered 13 malicious Composer theme packages on Packagist that inject JavaScript into Vietnamese streaming sites and, on iPhones, deliver a multi-stage exploit chain that ends in spyware and wallet theft. The campaign spans five vendor namespaces, uses FUNNULL-backed infrastructure, and includes the redeployment of fresh loaders and payloads to target unpatched iOS devices. #OphimCMS #KKPhim #FUNNULL #Packagist #Apple #WebKit
BrainCipher ransomware impacted syc.es in Spain by encrypting files and disrupting services. The claim associated with this incident was made in Spain #Spain
BrainCipher ransomware targeted aeiconsultants.com in the US, compromising systems and encrypting data to extort a ransom. The incident highlights the impact of BrainCipher’s attack on organizations operating in #UnitedStates
BrainCipher allegedly deployed ransomware against icot.es in Spain, encrypting files and disrupting operations while threatening to leak or sell stolen data. The victim is located in #Spain
A signed adware-like installer was abused to deploy the ValleyRAT backdoor through DLL sideloading, disabling Windows Defender and persisting via startup entries. The campaign used QN Wallpaper components and targeted users mainly in China and India, with activity linked to Silver Fox. #ValleyRAT #QNWallpaper #SilverFox
The Trump administration launched Project Watershed 250, a six-month pilot in Texas that brings together federal, state, and private-sector expertise to strengthen water system defenses. The initiative follows recent attacks on U.S. water infrastructure and aims to find vulnerabilities, harden systems, and scale proven protections nationwide. #ProjectWatershed250 #TexasCyberCommand #SeanCairncross
Microsoft is investigating a widespread Exchange Online incident that is causing authentication problems, email delays, and mailbox access failures for many users. The outage, tracked as EX1464935 and later MO1465074, also affects other Microsoft 365 services including OneDrive for Business, SharePoint Online, Microsoft Teams, Microsoft Purview, and Microsoft Defender XDR. #ExchangeOnline #Microsoft365 #OneDriveforBusiness #SharePointOnline #MicrosoftTeams #MicrosoftPurview #MicrosoftDefenderXDR
TerminalFix is a new ClickFix variant that uses fake Cloudflare CAPTCHA prompts on compromised sites to trick victims into running malicious PowerShell commands in Windows Terminal. Microsoft says the multi-stage attack can establish a reverse tunnel into internal networks, enabling recon, persistence, and potential follow-on actions like credential theft or ransomware deployment. #TerminalFix #Cloudflare #WindowsTerminal #PowerShell
Orient Blackswan, a publishing house based in Hyderabad, was hit by a ransomware attack that disrupted its IT infrastructure and encrypted critical business data. The attackers demanded Rs 20 million to restore access, and the affected systems were isolated to prevent further spread. #OrientBlackswan #Hyderabad
McKesson said it was hit by a cyberattack attributed to ShinyHunters, which led to data theft from a third-party application and affected customer information, including oncology and surgery units. The company has notified regulators and customers, while intermittent service degradation continues to be reported. #McKesson #ShinyHunters
A single unpatched JetBrains TeamCity server on api.cadence.jetbrains.com was exploited through CVE-2026-63077, giving attackers access to Cadence cloud infrastructure, backups, and sensitive developer secrets. The breach exposed AWS IAM credentials, S3 buckets, and potentially source code, repository tokens, package registry keys, SSH keys, and signing keys, forcing immediate credential revocation and…