Emerging Threats

A single unpatched flaw in a Dell storage appliance became a playground for hackers, allowing months of undetected espionage and the deployment of sneaky new backdoors. A joint investigation by Mandiant and Google Threat Intelligence Group uncovered this alarming zero-day exploit, which has been wreaking havoc since mid-2024.

Kubernetes Environments Under Siege as Attacks Escalate

Kubernetes environments are under attack like never before, with threat actors exploiting identities and critical vulnerabilities to compromise cloud infrastructure - so what can organizations do to protect themselves? The warning signs are clear: it's time to take action against escalating Kubernetes attacks.

Iranian Actors Exploit OT Vulnerabilities in US Critical Infrastructure

US critical infrastructure is under threat as Iranian-linked actors exploit vulnerabilities in operational technology (OT) systems, allowing them to gain network access and potentially disrupt operations. The alarming warning from federal agencies highlights the urgent need to secure the nation's industrial backbone from these increasingly targeted attacks.

Hackers Exploit Flaw in Ninja Forms WordPress Plugin

A critical vulnerability in the Ninja Forms File Uploads premium WordPress plugin allows hackers to upload malicious files and execute code on your server - putting your entire site at risk. This flaw lets unauthenticated users wreak havoc, making it essential to take immediate action to protect your online presence.

Russian Hackers Exploit Router Flaws to Steal Microsoft Office Tokens

Russian hackers have been quietly stealing Microsoft Office tokens from users on over 18,000 networks by exploiting known flaws in older internet routers, and here's the kicker: they did it without installing any malicious software. This sneaky campaign, linked to Russia's military intelligence units, highlights the surprising vulnerability of legacy devices to secret siphoning.

Cybercrime Inflicts Record $21 Billion Loss on US Citizens

Last year, US citizens suffered a staggering $21 billion loss to cybercrime, a record that raises a crucial question: is the convenience of digital life worth the growing risk of fraud and theft? The alarming figure is largely driven by investment scams, business email compromise, tech support fraud, and data breaches.

Microsoft Device-Code Phishing Attacks Compromise Hundreds Daily

A shocking reality check: a sophisticated Microsoft device-code phishing campaign, dubbed "EvilTokens," is breaching hundreds of organizations daily, using AI and automation to snoop through corporate email inboxes and steal financial data. This alarming threat is making short work of traditional security measures, leaving businesses vulnerable to devastating attacks.

Cyberattack Cripples Massachusetts Hospital Operations

A devastating cyberattack has forced Signature Healthcare in Massachusetts to divert ambulances, cancel critical cancer treatments, and revert to paper-based procedures, putting patients' lives on hold. Every second counts as the hospital scrambles to respond to the attack and restore vital electronic systems.

Snowflake Breach Compounds as Hackers Exploit Integrator Vulnerability

A recent breach of a SaaS integration provider has led to a Snowflake data breach, with stolen authentication tokens being used to compromise the sensitive data of over a dozen companies. This devastating chain of events highlights the urgent need for robust security measures to protect against increasingly sophisticated cyber threats.

APT28 Hijacks SOHO Routers in Global DNS Espionage Push

Your home router, that innocent-looking box under your desk, can be turned against you: a Russia-linked cyber threat group, APT28, has been hijacking insecure SOHO routers worldwide to fuel a massive DNS espionage campaign. By exploiting vulnerabilities in popular router brands like MikroTik and TP-Link, they've been manipulating DNS settings to spy on unsuspecting users.

US Warns of Iranian Hackers Targeting Exposed Industrial Controls

When devices that connect our physical and digital worlds are left exposed to the public internet, they become an open invitation for hackers - and Iranian-linked cybercriminals are now actively targeting Internet-exposed industrial control systems, specifically Rockwell/Allen-Bradley programmable logic controllers, in US critical infrastructure organizations.

Flowise RCE vulnerability exploited in attacks

Hackers are actively exploiting a critical vulnerability in Flowise, a popular open-source AI tool, that allows them to take control of systems designed to run code - a fundamental flaw that raises serious questions about securing AI-powered applications. This maximum-severity flaw, tracked as CVE-2025-59528, has left developers, organizations, and regulators scrambling for answers.

NCSC Warns of Russia's Ongoing Router Exploits

Russia's notorious hackers, Fancy Bear, are exploiting routers to steal passwords and sensitive information, compromising the security of countless individuals and organisations. With around 5,000 devices and 200 organisations already affected, experts warn that this latest threat is one to take seriously.

APT28 Hijacks Routers to Steal Credentials via Malicious DNS Servers

Beware of invisible hands rerouting your online traffic: a state-linked Russian hacking group, APT28, has been hijacking routers to intercept credentials by manipulating DNS servers, putting your online security at risk. This stealthy tactic allows them to capture user authentication data, compromising your digital identity.

Law Enforcement Disrupts APT28's Router DNS Hijack Operation

In a major breakthrough, an international coalition of law enforcement authorities and private companies has successfully disrupted a sneaky DNS hijack operation by APT28, known as FrostArmada, that targeted home network routers to steal Microsoft account credentials. This operation thwarted the hackers' plan to intercept traffic and harvest cloud account keys, protecting countless individuals from potential cyber threats.

GrafanaGhost Exploit Bypasses AI Defenses for Covert Data Theft

A newly discovered exploit, dubbed GrafanaGhost, has been found to cleverly bypass AI defenses, allowing for covert data theft by chaining together AI prompt injection and URL-handling flaws. This sneaky attack enables silent exfiltration of sensitive Grafana data, catching users off guard.

ComfyUI Instances Enlisted in Widespread Cryptomining Botnet Campaign

A sneaky campaign is on the hunt for exposed ComfyUI instances, using them to fuel a cryptomining botnet and secretly install malicious nodes - putting unsuspecting users' systems at risk. This covert operation uses a Python scanner to scour cloud IP ranges, exploiting vulnerabilities and turning systems into cryptocurrency-mining machines.

FBI Warns of $17bn Cyber Fraud Surge

The FBI has sounded the alarm on a staggering $17 billion surge in cyber fraud, with cryptocurrency scams alone accounting for over $7 billion in losses - and experts warn that AI-enabled threats are on the rise. This isn't just a minor annoyance, it's a massive financial hemorrhage that's happening right now.

Fortinet Rushes Patch for Exploited FortiClient EMS Vulnerability

Fortinet has rushed out an emergency patch for a zero-day vulnerability in its FortiClient EMS product, which was being exploited by attackers before the fix was even available. This swift response aims to protect businesses from potential security breaches through its endpoint security clients.

Microsoft Uncovers Storm-1175's Medusa Ransomware Link

Microsoft just dropped a crucial report linking Storm-1175, a notorious threat actor, to high-velocity Medusa ransomware attacks that exploit flaws in networked systems. This newly uncovered connection raises the alarm for anyone building, defending, or relying on these systems to stay vigilant against Medusa ransomware attacks.

China-Linked Storm-1175 Weaponizes Zero-Days to Fuel Medusa Ransomware Blitz

Medusa ransomware attacks are happening at alarming speed, thanks to a China-linked threat actor called Storm-1175 that is exploiting a potent mix of zero-day and known vulnerabilities to rapidly infect exposed systems. This high-velocity campaign is a stark reminder of the evolving ransomware threat landscape.

Flowise AI Platform Faces Active RCE Exploitation

A critical vulnerability in Flowise, an open-source AI platform used by over 12,000 public instances, is being actively exploited, allowing attackers to run arbitrary code and take control. This maximum-severity flaw, tracked as CVE-2025-59528, demands immediate attention from Flowise operators to prevent devastating attacks.

Germany Names REvil, GandCrab Ransomware Leaders

German federal police have identified two Russian nationals as the masterminds behind the notorious REvil and GandCrab ransomware operations, shedding light on the elusive leaders of a global extortion network. This breakthrough has significant implications that extend far beyond a single investigation.

GPUBreach Attack Exploits GPU Memory for System Takeover

A newly discovered vulnerability, dubbed GPUBreach, allows hackers to exploit modern GPU memory and take control of an entire machine by inducing Rowhammer bit-flips in GDDR6 memory. This alarming attack can escalate privileges and lead to a full system compromise, leaving no room for complacency.