[SPONSOREDNUBIVANCE]
Know a small business winging it on security?
No IT department, no security budget, real exposure. Nubivance builds right-sized security foundations for small companies. Send them this.
Send it alongEmerging Threats
North Korean Hackers Expand Malicious Package Reach Across Multiple Coding Ecosystems
Beware of the Trojan horse in your code: North Korean hackers have quietly infiltrated multiple package ecosystems, publishing around 1,700 malicious packages that masquerade as legitimate developer tools but act as malware loaders. This sneaky campaign, linked to the Contagious Interview group, puts developers and organizations relying on shared code on high alert.
Iranian Hackers Infiltrate US Critical Infrastructure via OT Weaknesses
US critical infrastructure providers are reeling from a wake-up call after Iranian-backed hackers exploited weaknesses in internet-exposed operational technology assets, causing disruption and financial loss. The alarming breach, revealed by the Cybersecurity and Infrastructure Security Agency, highlights the high stakes of vulnerable systems.
Iran-Linked Hackers Target Internet-Exposed PLCs in US Infrastructure
Iran-affiliated hackers are launching targeted cyber attacks on internet-exposed devices controlling US critical infrastructure, including power plants, water systems, and manufacturing lines. This urgent threat requires immediate attention to protect vulnerable systems from devastating intrusions that can diminish functionality and manipulate operations.
Ransomware Ecosystem Evolves Amid Profitability Decline
The ransomware ecosystem is evolving, with the threat remaining alarmingly widespread across industries and regions, yet the business model fueling it is showing signs of strain. This paradox has emerged as ransomware-as-a-service and specialization have driven its growth, despite declining profitability.
Kaspersky Uncovers Horabot Campaign Targeting Mexico
Kaspersky's Security Operations Center has uncovered a complex Horabot campaign targeting Mexico, and is now sharing crucial insights on how it works and how to detect it. This critical threat intelligence will help defenders in Mexico and beyond prioritize their resources and stay one step ahead of the threat.
DarkSword Exploit Chain Spreads Across Threat Actors
A single iOS exploit chain, known as DarkSword, has been spreading rapidly among threat actors, allowing multiple groups to fully compromise iPhones across several countries. This compact, multi-vulnerability exploit leverages zero-day vulnerabilities to achieve complete device takeover, and was first detected in the wild in November 2025.
Iran-Backed Hackers Infiltrate US Industrial Controls
US cyber and intelligence agencies have sounded the alarm: pro-Iran hackers have infiltrated and disrupted critical US infrastructure, including water and energy systems, posing a pressing threat to national security. These foreign actors have breached government networks and industrial controls, sparking urgent concerns about the vulnerability of America's essential services.
FBI Report Exposes Soaring Cybercrime Losses
Cybercrime losses have skyrocketed 26% to a staggering $20.9 billion in 2025, but the true extent of the damage is likely much worse, as many victims suffer in silence, never reporting the crimes they endure.
TeamPCP Infiltrates Security Infrastructure with Multi-Stage Supply Chain Attack
When security tools meant to safeguard networks become the entry point for attacks, trust is shattered - and that's exactly what's happening with TeamPCP's multi-stage supply chain attacks on security infrastructure. This sinister tactic lets threat actors turn protectors into launchpads for wider compromise.
Mandiant Report Reveals Evolving Cyber Threat Tactics
Discover the alarming evolution of cyber threats in Mandiant's M-Trends 2026 report, which reveals a stark reality: attackers are now operating under two distinct playbooks, drastically changing the detection, response, and risk landscape. The report uncovers a significant increase in global median dwell time to 14 days, with some attacks lingering for as long as 122 days.
Feds Warn of Iranian Cyberattacks on US Energy, Water Systems
US government agencies have issued an urgent warning that Iranian hackers are launching targeted cyberattacks on America's energy and water infrastructure, posing a serious threat to the communities that rely on them. These attacks have already caused harm to victims in the past month, highlighting the need for immediate vigilance.
Unit 42 Uncovers Axios Supply Chain Attack's Far-Reaching Consequences
When a trusted software pathway is compromised, the consequences can be far-reaching - as Unit 42's recent analysis of the Axios supply chain attack starkly reveals, threatening digital trust and resilience. The team's detailed examination exposes the attack's full chain, from initial dropper to forensic cleanup.
North Korea-linked actor compromises axios NPM package
A shocking discovery by Google Threat Intelligence Group has exposed a vulnerability in the popular axios NPM package, which has over 100 million weekly downloads, and has raised urgent questions about the trustworthiness of software supply chains. A malicious dependency was secretly introduced into axios releases, putting countless applications at risk.
Kaspersky Uncovers Coruna Exploit Kit Linked to Operation Triangulation
Kaspersky's researchers have made a significant discovery: the Coruna exploit kit, now targeting iPhones, uses an updated kernel exploit linked to the notorious Operation Triangulation. This finding highlights the evolving threat landscape, where offensive code is repurposed to target new devices.
Feds Disrupt Russia-Backed Espionage Network Infecting 18,000 Devices
Federal authorities have successfully disrupted a massive Russia-backed espionage operation that had infiltrated nearly 18,000 devices, stealing sensitive account credentials and tokens by hijacking internet traffic. This significant takedown thwarts the efforts of Forest Blizzard, a notorious threat group linked to Russia's GRU.
VMware vSphere Ecosystem Targeted by BRICKSTORM Malware Attacks
Imagine an attacker sneaking past your trusted operating system and into the hidden infrastructure that powers your virtual machines - that's the risk posed by BRICKSTORM malware, which targets the VMware vSphere ecosystem. This stealthy threat allows adversaries to operate undetected, evading traditional endpoint tools by establishing persistence at the virtualization layer.
[SPONSOREDNUBIVANCE]
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
Malicious AI Gateway Exposes Data Through Supply Chain Breach
A recent analysis of LiteLLM, a popular AI gateway, revealed a supply chain breach that embedded malicious code designed to steal sensitive data, highlighting the vulnerability of even the most trusted components. This breach turned a multifunctional gateway meant to enhance AI agents into a vector for data theft, putting countless users at risk.
Hackers Target Asia Pacific with URL-Based Threats
In Asia Pacific, hackers are ditching traditional tactics and using URL-based threats to gain easy access to your digital life - with just one click, your security can be compromised. This emerging threat landscape is redefining how we think about online identity, access, and trust.
Ransomware Evolves with AI-Fueled Mutation Tactics
The game-changing threat of AI-fueled ransomware is here: hackers can now wield polymorphic malware that mutates on the fly, making it exponentially harder to detect and stop. This emerging menace is made possible by ransomware-as-a-service platforms supercharged with artificial intelligence.
Kaspersky Uncovers CrystalX RAT with Extensive Spyware and Stealer Capabilities
Meet CrystalX, a sinister new remote-access tool that's being sold as a ready-made menace, packing an alarming combination of spyware, stealer, and prankware capabilities that put your digital security at risk. This malicious toolkit is the latest threat to watch out for, and Kaspersky researchers are sounding the alarm.
Scams Evolve, Target Human Judgment in AI-Driven Attacks
As cyberattacks evolve, they're no longer targeting weak spots in code or networks, but rather the weakest link of all - human judgment. With AI-driven scams on the rise, attackers are exploiting trust and manipulating people into becoming the unwitting victims of their clever tactics.
FBI Warns of Iranian Cyberattacks on US Water and Energy Facilities
The FBI is sounding the alarm: Iranian-affiliated hackers are increasingly targeting US water and energy facilities, with some attacks already disrupting operations. Is your facility's infrastructure secure from these growing threats?
Anthropic Warns AI Model Exploits Zero-Day Vulnerabilities
Imagine building a tool to accelerate progress, only to discover it can also create the keys to your kingdom's vulnerabilities - that's the dilemma the security community now faces with Anthropic's AI model that can generate zero-day exploits. This emerging threat redefines the risk landscape, eclipsing long-held fears of quantum computers and introducing a new digital menace.
Akira Ransomware Group Accelerates Attacks, Hits Encryption in Under an Hour
The Akira ransomware group has supercharged its attacks, able to go from gaining a foothold to locking files in under an hour - the time it takes to pour a cup of coffee. This lightning-fast approach drastically shrinks the window for defenders and ups the ante for victims to pay the ransom.