[SPONSOREDNUBIVANCE]
Know a small business winging it on security?
No IT department, no security budget, real exposure. Nubivance builds right-sized security foundations for small companies. Send them this.
Send it alongIntelligence Briefing
Latest Analysis
Cybersecurity intelligence, threat analysis, and national security reporting.
APT28 Hijacks SOHO Routers in Global DNS Espionage Push
Your home router, that innocent-looking box under your desk, can be turned against you: a Russia-linked cyber threat group, APT28, has been hijacking insecure SOHO routers worldwide to fuel a massive DNS espionage campaign. By exploiting vulnerabilities in popular router brands like MikroTik and TP-Link, they've been manipulating DNS settings to spy on unsuspecting users.
US Warns of Iranian Hackers Targeting Exposed Industrial Controls
When devices that connect our physical and digital worlds are left exposed to the public internet, they become an open invitation for hackers - and Iranian-linked cybercriminals are now actively targeting Internet-exposed industrial control systems, specifically Rockwell/Allen-Bradley programmable logic controllers, in US critical infrastructure organizations.
AI-Powered Cybercrime Surges, US Losses Hit $20 Billion Record
Meet the new face of cybercrime: AI-powered scams that supercharge old cons with modern automation, resulting in a record-breaking $20 billion in losses in the US. Bots and artificial intelligence are helping crooks scale their schemes like never before, making cybercrime more efficient and devastating.
Flowise RCE vulnerability exploited in attacks
Hackers are actively exploiting a critical vulnerability in Flowise, a popular open-source AI tool, that allows them to take control of systems designed to run code - a fundamental flaw that raises serious questions about securing AI-powered applications. This maximum-severity flaw, tracked as CVE-2025-59528, has left developers, organizations, and regulators scrambling for answers.
NCSC Warns of Russia's Ongoing Router Exploits
Russia's notorious hackers, Fancy Bear, are exploiting routers to steal passwords and sensitive information, compromising the security of countless individuals and organisations. With around 5,000 devices and 200 organisations already affected, experts warn that this latest threat is one to take seriously.
GPU Rowhammer Flaw Enables System Compromise via Memory Corruption
Researchers have uncovered a chilling new threat: GPUBreach, a flaw that uses GPU Rowhammer to corrupt memory, granting hackers a backdoor to escalate privileges and take control of your entire system. This sneaky attack exploits GDDR6 memory, flipping bits and paving the way for a complete system compromise.
Government Agencies Transform Contact Centers to Meet Evolving Citizen Needs
Join the Contact Center Transformation Summit on April 8, 2026, to explore how government agencies can evolve to meet changing citizen needs and ensure seamless access to essential benefits. This summit brings together leaders and experts to share insights and best practices for transforming contact centers in the public sector.
White House Slashes CISA Funding by $707 Million
The White House's plan to slash $707 million from CISA funding raises critical questions about the impact on the agency's vital services and the trade-offs policymakers will have to make. This massive cut will have far-reaching consequences for the people who rely on CISA's work to keep them safe and secure.
APT28 Hijacks Routers to Steal Credentials via Malicious DNS Servers
Beware of invisible hands rerouting your online traffic: a state-linked Russian hacking group, APT28, has been hijacking routers to intercept credentials by manipulating DNS servers, putting your online security at risk. This stealthy tactic allows them to capture user authentication data, compromising your digital identity.
Docker Flaw Exposes Hosts to Unauthorized Access
A recent security patch meant to tighten up Docker Engine's defenses has left a gaping hole, exposing hosts to unauthorized access - and it's up to you to make sure you're not the one who gets exploited. A high-severity flaw, tracked as CVE-2026-34040, allows attackers to bypass authorization plugins and potentially gain access to your host.
Law Enforcement Disrupts APT28's Router DNS Hijack Operation
In a major breakthrough, an international coalition of law enforcement authorities and private companies has successfully disrupted a sneaky DNS hijack operation by APT28, known as FrostArmada, that targeted home network routers to steal Microsoft account credentials. This operation thwarted the hackers' plan to intercept traffic and harvest cloud account keys, protecting countless individuals from potential cyber threats.
Federal Agencies Leverage AI to Upgrade Proactive Service Delivery
Today's citizens expect to interact with federal agencies in a multitude of ways, from traditional phone calls to modern chatbots, posing a strategic challenge: how can agencies shift from reactive to proactive service delivery, anticipating citizens' needs before they even ask? By upgrading to proactive service delivery, agencies can meet the evolving expectations of a diverse population.
Defense Agencies Pursue Multi-Cloud Strategies to Bolster Operational Tempo
As defense agencies shift their focus beyond mere cloud migration metrics, they're now prioritizing a new set of goals that will give them a decisive edge in the digital landscape. They're leveraging multi-cloud strategies to drive decision advantage at scale, financial transparency, and operational tempo.
GrafanaGhost Exploit Bypasses AI Defenses for Covert Data Theft
A newly discovered exploit, dubbed GrafanaGhost, has been found to cleverly bypass AI defenses, allowing for covert data theft by chaining together AI prompt injection and URL-handling flaws. This sneaky attack enables silent exfiltration of sensitive Grafana data, catching users off guard.
ComfyUI Instances Enlisted in Widespread Cryptomining Botnet Campaign
A sneaky campaign is on the hunt for exposed ComfyUI instances, using them to fuel a cryptomining botnet and secretly install malicious nodes - putting unsuspecting users' systems at risk. This covert operation uses a Python scanner to scour cloud IP ranges, exploiting vulnerabilities and turning systems into cryptocurrency-mining machines.
Automated Pentesting Tools Hit PoC Plateau
Automated pentesting tools can deliver impressive early results, quickly uncovering low-hanging fruit and generating proof-of-concept failures - but often hit a plateau, leaving significant attack surfaces untested and creating a validation gap that's hard to ignore. This phenomenon, known as the PoC cliff, can abruptly halt progress, causing detection and exploitation attempts to drop off and tools to stop producing actionable findings.
[SPONSOREDNUBIVANCE]
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
Recurring Credential Incidents Drain Corporate Finances
Did you know that a single credential security breach can cost a whopping $4.4 million, making it a top priority for businesses to prevent? But while avoiding a major incident is crucial, what's often overlooked are the recurring credential incidents that quietly drain corporate finances.
FBI Warns of $17bn Cyber Fraud Surge
The FBI has sounded the alarm on a staggering $17 billion surge in cyber fraud, with cryptocurrency scams alone accounting for over $7 billion in losses - and experts warn that AI-enabled threats are on the rise. This isn't just a minor annoyance, it's a massive financial hemorrhage that's happening right now.
New Mexico Ruling Threatens End-to-End Encryption
A recent New Mexico court ruling against Meta has sparked a crucial debate: is it riskier to have social platforms that shield private messages with end-to-end encryption, or to leave them exposed for law enforcement to scrutinize? This case highlights the tricky trade-offs between user privacy and public safety.
Hong Kong Police Gain Power to Seize Encryption Keys
Imagine landing in Hong Kong and being asked to hand over your phone's password or laptop's encryption key - blurring the line between a routine border check and an invasion of your private life. A recent change to the city's National Security Law now empowers police to demand this access from anyone, even transit passengers.
Fortinet Rushes Patch for Exploited FortiClient EMS Vulnerability
Fortinet has rushed out an emergency patch for a zero-day vulnerability in its FortiClient EMS product, which was being exploited by attackers before the fix was even available. This swift response aims to protect businesses from potential security breaches through its endpoint security clients.
GPUBreach Attack Escalates CPU Privileges via Graphics Units
Imagine a scenario where the very processor that powers your gaming experiences or fuels your AI models becomes a vulnerability that attackers can exploit to hijack your entire machine - new research reveals that this is no longer just a theoretical threat. A recently discovered attack, dubbed GPUBreach, can escalate CPU privileges through graphics units, leaving your system exposed to potential takeover.
Microsoft Uncovers Storm-1175's Medusa Ransomware Link
Microsoft just dropped a crucial report linking Storm-1175, a notorious threat actor, to high-velocity Medusa ransomware attacks that exploit flaws in networked systems. This newly uncovered connection raises the alarm for anyone building, defending, or relying on these systems to stay vigilant against Medusa ransomware attacks.
China-Linked Storm-1175 Weaponizes Zero-Days to Fuel Medusa Ransomware Blitz
Medusa ransomware attacks are happening at alarming speed, thanks to a China-linked threat actor called Storm-1175 that is exploiting a potent mix of zero-day and known vulnerabilities to rapidly infect exposed systems. This high-velocity campaign is a stark reminder of the evolving ransomware threat landscape.