Summary Conducting an external website scan for indicators of compromise is one of the easiest ways to identify security issues. While remote scanners may not provide as comprehensive of a scan as server-side scanners, they allow users to instantly identify malicious code and detect security i…
Key Points ReliaQuest has observed 246% more business email compromise (BEC) attempts over the past year; this highlights the growing risk of fraud or other damage caused by cyber attacks, relevant to all sectors and countries. We have developed an advanced detection approach for organizations to id…
The report analyzes four China-linked APT incidents (Volt Typhoon, APT27, APT31, and BlackTech) that targeted organizations using operational technology, describing the TTPs used to access, persist, and potentially disrupt OT environments. It highlights router…
Researchers at CISPA disclosed a new application-layer Denial-of-Service technique that pairs UDP-based services so they continuously exchange messages, creating self-sustaining traffic loops that can deny service. The flaw affects both legacy and modern UDP a…
In this report, we share our latest Android malware findings: the Tambir spyware, Dwphon downloader and Gigabud banking Trojan.
This joint guide, Understanding and Responding to Distributed Denial-Of-Service Attacks, addresses the specific needs and challenges faced by organizations in defending against DDoS attacks. The guidance now includes detailed insight into three different types of DDoS techniques: Volumetr…
The analysis documents an njRAT infection chain beginning with a malicious PowerPoint (AutoOpen macro) that fetches staged payloads from Pastebin/textbin, ultimately decoding into two .NET binaries (a DLL and an EXE) with keylogger and C2 functionality. Analys…
Introduction In late 2023 and early 2024, the ransomware ecosystem experienced repeated disruption of its most prolific Ransomware-as-a-Service (RaaS) groups at the hands of international Law Enforcement (LE). Alphv’s dark web data leak site was seized, then unseized, then re-seized in a December 20…
RansomHub is a newly emerged ransomware group operating as a ransomware-as-a-service (RaaS) with an affiliate model and a policy aimed at rewarding partners, including a 90/10 revenue split and a decryptor promise under certain conditions. Their victimology sp…
Pig butchering is a scalable social-engineering scam that builds trust through romantic manipulation to extract money from victims, often via crypto apps or direct transfers. The post also highlights Turla’s TinyTurla-NG backdoor and broader security and polic…
Mandiant observed APT29 distributing CDU-themed phishing lures that redirected victims to a compromised site (waterforvoiceless[.]org) hosting a ROOTSAW dropper which retrieved the WINELOADER backdoor. WINELOADER is deployed via DLL side‑loading, uses RC4 to d…
A malware campaign offering malware-as-a-service (MaaS) is targeting Android users based in India.According to Broadcom, the campaign distributes malicious APK packages and seeks out banking information, SMS messages, and other sensitive information from a victim’s device. This campaign is acti…
An international freight technology company said it has cut off a portion of its business in Canada after a cyberattack. The company — Radiant Logistics — did not respond to requests for comment about whether it was dealing with a ransomware attack. In documents filed with U.S. regulators, the compa…
An Australian IT contractor has been sentenced to 30 months jail for ripping off the National Maritime Museum. The nonprofit museum celebrates Australia’s maritime heritage – a matter of some import for the island nation, which therefore attracts government funding. Among the museum’s exhibits is a…
Ivanti addressed a critical remote code execution vulnerability, tracked as CVE-2023-41724 (CVSS score of 9.6), impacting Standalone Sentry solution. An unauthenticated attacker can exploit this vulnerability to execute arbitrary commands on the underlying operating system of the appliance within th…