[SPONSOREDNUBIVANCE]
Know a small business winging it on security?
No IT department, no security budget, real exposure. Nubivance builds right-sized security foundations for small companies. Send them this.
Send it alongEmerging Threats
AI-Powered Phishing Attacks Force Defenders to Deploy Counter-Agents
Get ready for Phishing 3.0, where AI-powered attacks are revolutionizing the game, forcing defenders to level up their security strategies with cutting-edge counter-agents. AI-driven phishing is no longer just about malicious links and emails - it's a sophisticated, multi-channel threat that's researching, adapting, and striking with precision.
Hackers Exploit Dahua Devices via Credential Attacks and Auth Bypasses
Over 14,530 Dahua devices were compromised in a massive cyberattack, dubbed Operation CameraSwarm, which used credential attacks and authentication bypasses to gain control of cameras and other devices. The attackers hit hard in Ukraine and Russia, infiltrating devices via exposed credentials, flaws, and peer-to-peer relay tech.
China-linked SilkParasite campaign targets Central Asia with custom RATs
Meet SilkParasite, a sneaky espionage operation linked to China that's been targeting government bodies in Central Asia with a custom arsenal of Remote Access Tools. This sophisticated campaign boasts seven unique RAT families, five of which have never been seen before, and hints at AI-assisted development.
CISA Warns of Active Exploitation of Critical Flaws in macOS, SharePoint, vCenter, and Microsoft IKE
Critical flaws in macOS, SharePoint, vCenter, and Microsoft IKE are under active attack, with 361 victim IP addresses across 47 countries already compromised. CISA has sounded the alarm, adding these vulnerabilities to its Known Exploited Vulnerabilities catalog.
Hackers Exploit 2,000 WordPress Sites in StopAndProtect Malware Campaign
This sneaky malware campaign, known as StopAndProtect, has already hacked nearly 2,000 WordPress sites, using a powerful toolkit that encrypts files, steals sensitive documents, and even lets attackers chat with their victims in real-time. The damage is widespread, with over 6,000 unique IP addresses affected worldwide.
Medusa Ransomware Targets Over 500 Infrastructure Orgs, Expands Tactics
Medusa ransomware has hit a staggering 500+ critical infrastructure organizations, with healthcare being a prime target, as reported in a recent FBI advisory. The attacks are happening at an alarming rate, with exploitation windows as short as 24 hours or even less.
Hackers Actively Exploit Windows IKE Flaw
Hackers are actively exploiting a critical Windows flaw, known as CVE-2026-33824, that lets them execute code over a network, putting your system at risk. This vulnerability, found in the Windows Internet Key Exchange (IKE) Service Extensions, affects all supported Windows 10 and other Windows systems.
Clop Ransomware Operation Exploits Windchill Flaw with Custom Web Shell
The Clop ransomware operation has exploited a critical flaw in PTC Windchill and FlexPLM servers, deploying a custom web shell that allows for easy credential theft and massive data exfiltration. This sneaky move gives attackers a direct path to sensitive data, with no extra tools needed.
Microsoft Uncovers 30+ Domains Linked to MacSync Stealer Infrastructure
Microsoft's investigation has uncovered a sneaky operation: over 30 domains are secretly linked to MacSync Stealer, a notorious macOS information stealer, and are actively siphoning off sensitive data. The company confirmed that data exfiltration is happening in real-time, not just sending out distress signals.
Medusa Ransomware Targets Over 500 US Critical Infrastructure Orgs
The Medusa ransomware gang has struck a staggering 500+ US critical infrastructure organizations across multiple sectors, including healthcare, defense, and finance, since June 2021. This alarming surge in attacks has prompted a joint warning from top US agencies, highlighting the urgent need for heightened cybersecurity measures.
US Recharges Indictment Against Iranian Hackers Tied to Mabna Institute
The US has ramped up its pursuit of justice against Iranian hackers, expanding an indictment to charge 17 individuals affiliated with the notorious Mabna Institute, which allegedly compromised over 100,000 professors' email accounts worldwide. This move marks a significant escalation in the case, with eight new defendants added to the original 2018 indictment.
Quest Breach Exposes Guests' Personal Data Through Third-Party Vulnerability
We've got some important news to share with you: Quest recently discovered a security issue with one of its third-party service providers that may have exposed some of your personal data. The company quickly sprang into action to contain the breach and is now reaching out to affected guests.
Ransom Busters Emerges as New Player in Ransomware Extortion Economy
Meet Ransom Busters, a newcomer to the ransomware extortion economy that's shaking things up with its bold approach: offering to delete stolen data from ransomware groups' servers for a fee of $20,000 to $60,000. This third-party player claims to have been infiltrating ransomware-as-a-service operations for over three years.
Attackers Exploit MLflow Flaw to Steal Cloud Credentials
A newly discovered vulnerability in MLflow, CVE-2026-64849, with a near-perfect CVSS score of 9.3 is being exploited by attackers to infiltrate cloud metadata services and steal sensitive credentials. This critical flaw allows hackers to issue unauthorized requests and extract confidential data, putting your cloud security at risk.
Medusa Ransomware Expands Reach with New Tactics, Hundreds More Victims
The Medusa ransomware gang is on the loose, exploiting unpatched software to target hundreds of victims across various sectors, with the Healthcare and Public Health industry being a frequent hit. Now, US agencies have issued an updated warning, detailing the group's latest tactics and partnerships.
Clop Ransomware Gang Crafts Custom Web Shell for Windchill Attacks
The Clop ransomware gang has taken its attacks to the next level by crafting a custom Java web shell that specifically targets PTC Windchill and FlexPLM servers, allowing them to harvest sensitive data with ease. This tailored tool is a significant evolution of their mass-exploitation tactics, making it a major concern for businesses using these applications.
[SPONSOREDNUBIVANCE]
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
Supply Chain Hack Exposes Pokémon Center Customer Data
A recent supply chain hack exposed sensitive customer data at the Pokémon Center, but fortunately, the breach occurred through a third-party logistics partner, CEVA, and not directly through the retailer's own systems. The incident, triggered by CEVA's notification on July 30, compromised customer order details for Pokémon Center's UK and German shipments.
CISA Mandates Swift Fix for Exploited Ray RCE Flaw
A critical bug in the Ray framework, scoring 9.4 under CVSS v4, can be exploited for remote code execution with a simple visit to a malicious web page or hostile ad in Firefox or Safari. This vulnerability can be triggered when an attacker crafts requests that appear browser-originated, allowing for a potentially disastrous security breach.
TWINLOOT Exploits Microsoft Services to Steal Credentials
Meet TWINLOOT, a sneaky Python implant that hides its command-and-control infrastructure inside trusted Microsoft services, making it super hard to detect. It uses SharePoint Online and Microsoft Teams to operate undetected, even leveraging a victim's own Edge browser to blend in.
Microsoft Copilot Exposes Vulnerability to Meta-Hacking
Researchers at Varonis Threat Labs uncovered a vulnerability in Microsoft Copilot, cleverly manipulating it to reveal its own weaknesses and craft a working attack, which they've dubbed CoSnitch. This surprising exploit was responsibly disclosed to Microsoft, which plans to issue a patch.
Salesforce, ServiceNow Portals Targeted in Ongoing Data Scraping Campaign
A single virtual private server has been secretly siphoning off sensitive records from Salesforce and ServiceNow customer portals since March 2025, according to recent research by Reco. This ongoing data scraping campaign, dubbed City Forum, has been quietly pulling data from multiple targets across various sectors.
Typosquatting Campaign Targets RubyGems Users with Windows Stealer
Beware of a sneaky typosquatting campaign targeting RubyGems users: 16 malicious packages were used to spread a Windows stealer that harvests sensitive data, including browser credentials, cryptocurrency wallets, and Telegram info. This malware can strike when you least expect it, putting your online security at risk.
Cyber Incident Disrupts UT San Antonio's Student Services
The University of Texas at San Antonio swiftly contained a potential cyber threat after detecting suspicious activity on the edge of its network, and took swift action to protect its systems and data. Thankfully, the incident appears to have been effectively managed, with no evidence of data compromise reported so far.
Ransomware Attacks Singly Target Mid-Market Firms
Ransomware attacks are hitting mid-market firms with alarming frequency, and the threat is only escalating as AI-powered tools rapidly uncover new vulnerabilities at an overwhelming pace. Mid-market companies, with revenues between $10m and $1bn, now account for nearly three-quarters of ransomware attack victims.