Cybersecurity intelligence, threat analysis, and national security reporting.
Researchers uncovered a clever phishing campaign weaponizing innocent-looking SVG images to deliver a chain of malware — including PureRAT — that’s been targeting ministries, aid groups, and civilians in Ukraine and Vietnam. Stay wary of unexpected attachments and verify senders before you click, because even an image can be the gateway to credential theft and hidden cryptomining.
Microsoft warns that XCSSET — a persistent macOS malware — has evolved to hide inside Xcode project files, so compromised developer builds can silently steal crypto, disable defenses, and spread to users. Developers and teams should lock down build environments, tighten project integrity checks, and treat supply‑chain security as mission‑critical to keep apps and users safe.
Salesforce now faces a wave of lawsuits after customer data stolen from Salesloft surfaced in identity‑theft schemes, sparking a heated debate over who’s liable when third‑party integrations expose sensitive information. The outcome could reshape how platforms, vendors, and customers share responsibility for security in a cloud‑first world.
From outdated systems to AI-powered workflows, federal agencies can speed services, cut backlogs, and predict risks to stretch scarce resources — but doing it right means modernizing data, upskilling staff, and baking in strong safeguards so innovation boosts efficiency without sacrificing accountability.
A critical Perfect‑10 RCE in Fortra’s GoAnywhere MFT is being actively exploited, leaving thousands of internet‑facing instances at risk — patch immediately, isolate exposed servers, and audit logs to stop data theft or ransomware. This crisis spotlights gaps in vendor disclosure and supply‑chain risk, so organizations and vendors must coordinate fast to prevent widespread breaches.
LockBit 5.0 is back and scarier than ever — its native payloads can now hit Windows, Linux and VMware ESXi in one campaign, putting entire enterprises and virtualized workloads at risk. If you haven’t already, harden hypervisors, adopt cross-platform defenses, and treat ransomware as an enterprise survival priority.
Singapore is sounding the alarm after a spike in Facebook impersonation scams that have cheated residents and strained law enforcement, and officials are now publicly pressing Meta to act faster to protect users. If platforms don’t step up with better detection, verification and takedowns, trust — and people’s money and privacy — will keep eroding.
Could a $5 expired domain let a stranger trick your AI into spilling customer data? Researchers proved it with Salesforce’s Agentforce, a wake-up call that mundane trust failures in AI pipelines can lead to serious leaks and that continuous domain monitoring and layered safeguards are essential.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
A new wave of Russia-linked intrusions tied to COLDRIVER is using tiny but sneaky loaders—BAITSWITCH and SIMPLEFIX—to stay under the radar and make detection harder. Defenders and policymakers alike must lean on smarter telemetry, rapid sharing, and solid cyber hygiene to stop these modular campaigns before they spread.
Volvo North America says some employee records were accessed after a ransomware strike on HR supplier Miljödata, a reminder of how risky outsourcing payroll and benefits can be. Affected staff are being notified as investigators work the case — and the incident spotlights the urgent need for tougher vendor security and clearer breach rules.
Cisco ASA firewalls are once again under active attack by the ArcaneDoor campaign exploiting known flaws—putting critical networks and sensitive data at real risk. If you manage ASA devices, patch urgently, lock down admin access, and treat these appliances as high‑value targets before attackers do.
Cisco firewall flaws are being actively exploited — U.S. and U.K. agencies are urging immediate patches and mitigations. Don’t wait: update ASA/FTD devices, boost monitoring, and isolate critical assets now to stop attackers using your perimeter as a foothold.
Interpol’s Operation Contender 3.0 led to 260 arrests across Africa, disrupting the networks behind romance, investment and business-email scams. It’s a powerful coordinated strike — but experts warn arrests must be paired with better tech, policy and victim support to truly curb these adaptable, cross-border fraud rings.
Britain plans to issue government-backed digital IDs to all legal residents and may require them for right-to-work checks by 2029—promising faster hiring and fraud reduction but raising real concerns about privacy, exclusion and security. As the deadline approaches, lawmakers, employers and civil society must nail down safeguards to ensure the system helps people rather than locks them out.
A WatchTowr Labs investigation suggests attackers were exploiting a CVSS 10.0 flaw in Fortra’s GoAnywhere MFT as early as Sept. 10—seven days before public disclosure—forcing organizations to scramble from defense to damage control. If true, this zero-day is a wake-up call to inventory, patch, and assume breach now before the quiet access turns catastrophic.
Jaguar Land Rover has begun a phased restart after a cyberattack, prioritising supplier payments and reviving its parts logistics centre to steady production and reassure partners. While this quick, pragmatic recovery eases immediate disruption, the company still faces the work of forensic checks and stronger defenses to prevent future shocks.
No IT department, no security budget, real exposure. Nubivance builds right-sized security foundations for small companies. Send them this.
Send it along
Heads-up: a new macOS XCSSET variant now targets Firefox with a clipboard-clipper and stronger persistence—copied crypto addresses can be silently swapped and infections are harder to remove, so users and IT teams should verify addresses off‑clipboard and strengthen detections now.
Fed up with nonstop spam calls? The ICO has slapped two UK-linked firms with a combined £550,000 fine after offshore call centres blasted prerecorded marketing to people who never gave consent — a reminder that nuisance calls aren’t just annoying, they’re illegal, and stronger tech and enforcement are needed to protect our privacy.
LockBit’s latest variant is faster, stealthier and can run on multiple operating systems, meaning ransomware risk now extends well beyond traditional Windows targets. Act now—strengthen segmentation, offline backups, MFA and timely patching to blunt its impact.
Urgent: attackers are exploiting newly disclosed Cisco ASA zero‑days to deploy sophisticated, previously unseen malware families (RayInitiator and LINE VIPER), so inventory your ASA devices and apply Cisco’s patches or mitigations now to stop persistent access and lateral spread. Act fast—delays leave VPNs and perimeter defenses wide open to credential theft and follow‑on intrusions.
Imagine calling tech support and accidentally inviting a nation‑state backdoor into your PC — researchers say North Korea‑linked Lazarus tools are now showing up in everyday tech‑support scams, handing criminals far more powerful, persistent malware. That makes it more important than ever for people and organizations to rethink who they trust and how they secure devices.
A recent cyberattack on Kido International exposed photos and home addresses of preschoolers, leaving parents reeling and asking how we can better protect the kids in our care. This alarming breach shows why stronger security, clearer rules, and more support for small childcare providers are urgently needed.
A new critical flaw called ForcedLeak can trick Salesforce’s AgentForce into spilling sensitive CRM data via prompt-injection, turning a helpful AI assistant into a potential data leak. If you use AgentForce, now’s the time to check configurations, apply vendor guidance, and scan for suspicious activity to keep customer records safe.
Researchers say a seemingly legit npm package linked projects to a remote AI agent server that crawled and siphoned email content — possibly the first malicious “MCP” seen in the wild. It’s a wake‑up call to vet dependencies, tighten supply chains, and monitor CI/network egress before agentic AI becomes a standard attack tool.