[SPONSOREDNUBIVANCE]
Rapid7 deployed right the first time.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deploymentMalware & Ransomware
F5 Fixes Zero-Day Flaw Exploited in BIG-IP RCE Attacks
F5 has rolled out urgent security updates to fix a critical zero-day vulnerability in its BIG-IP APM product, which was being exploited in remote code execution attacks. The patch aims to shut down the exploit chain that attackers were using to breach systems.
China-Aligned Group Exploits Chrome, Microsoft Zero-Days
A China-aligned threat group has been exploiting a chain of three zero-day vulnerabilities in Google Chrome and Microsoft Windows, highlighting a coordinated effort within the Chinese computer network exploitation community. This alarming discovery reveals the group's ability to rapidly weaponize and customize exploits across multiple campaigns.
Windows Malware Exploits AI Models for Autonomous Post-Compromise Actions
Meet CLOSEDQUORUM, a sneaky Windows malware that outsources its decision-making to AI giants like Google Gemini and Mistral, allowing it to autonomously pull off post-compromise actions. This cunning code queries multiple AI models, tallying their votes to determine its next move - and even has a tiebreaker system in place!
Chinese hackers exploit flaws in WordPress, Zyxel to steal government data
In a massive cyberattack, hackers exploited vulnerabilities in WordPress and Zyxel to steal sensitive government data from 996 devices across 48 countries. The breach exposed device configurations, network info, and critical credentials, with one Western government organization losing over 18,000 records, including accounts and passwords.
Malicious npm Package Exploits Twilio Developers for Credential Theft
Malicious actors have struck again, this time with a fake npm package called tw-pkgprobe-7731 that masquerades as a security research tool to steal credentials from unsuspecting Twilio developers. The package was cleverly designed to evade detection, only collecting and exfiltrating sensitive data when it detected a Twilio developer environment.
Check Point Discloses Zero-Day Flaw in Management Server Exploited in Targeted Attacks
A high-severity zero-day flaw in Check Point's Security Management Server was exploited in targeted attacks on July 23, allowing hackers to upload and execute scripts without logging in. This critical vulnerability, scored 9.8 out of 10 on the CVSS scale, highlights the urgent need for patching and protection.
ShinyHunters Breach FBI Systems with Oracle PeopleSoft Zero-Day
Meet the hackers who just pulled off a massive heist: ShinyHunters claims to have stolen 2-3TB of sensitive data from FBI systems by exploiting a previously unknown flaw in Oracle PeopleSoft. The breach reportedly exposed personal info of current and former FBI employees, as well as applicant data.
AI-Powered Windows Malware Autonomously Decides Attack Steps
Meet ClosedQuorum, a sneaky new Windows malware that uses AI to call the shots - autonomously deciding its next move by gathering intel from infected hosts and getting advice from a panel of commercial AI models. This cutting-edge threat is making waves as the first publicly documented Windows implant to hand over tactical decisions to AI.
Zero-Day Tool Blocks Microsoft Defender Updates
Meet BigDiskBuster, a newly released zero-day tool that cleverly blocks Microsoft Defender updates by maxing out disk space, leaving users vulnerable until a fix is found. Its creator, Abdelhamid Naceri, a former Microsoft security researcher, has made the proof-of-concept tool publicly available on GitHub.
Microsoft Disrupts EvilTokens AI-Powered Phishing Service
Microsoft and its partners have successfully dismantled an AI-powered phishing service, known as EvilTokens, that had compromised over 12,000 email inboxes across 10,000 organizations worldwide. This court-authorized takedown marks a significant win in the fight against cybercrime.
Infostealers Expose Credentials at 1 in 5 US Water Organizations
Infostealer exposure puts 1 in 5 US water organizations at risk of devastating attacks, giving hackers legitimate entry points to wreak havoc. This alarming vulnerability highlights the urgent need for water and wastewater organizations to bolster their defenses.
Microsoft Disrupts EvilTokens Cybercrime Service
Microsoft and its partners have successfully dismantled the EvilTokens cybercrime service, seizing 50 websites and disabling over 175 domains used to target and exploit victims. This disruption was made possible through a powerful collaboration with industry leaders, including Cloudflare, OpenAI, and Coinbase, to protect potential victims and take down the operation.
Check Point Discloses Zero-Day Exploited in Management Server Attacks
A critical zero-day vulnerability in Check Point's Security Management Server has been exploited in the wild, allowing attackers to upload and run malicious scripts with ease. This flaw, tracked as CVE-2026-93616, has already been used to target a handful of customers, prompting Check Point to release emergency hotfixes.
Microsoft Disrupts EvilTokens Phishing Service, Arrests Suspects
Microsoft swooped in to dismantle the EvilTokens phishing service, a sneaky AI-powered operation that had already compromised 12,000 email inboxes across 10,000 organizations worldwide. The service, which emerged in February, was sold as a phishing kit and came equipped with a clever AI chatbot that helped scammers identify and target high-value victims.
Microsoft Disrupts EvilTokens Phishing Service Targeting 12,000 Accounts
Microsoft's Digital Crimes Unit has struck a major blow against cybercrime, disrupting the EvilTokens phishing service that targeted over 12,000 accounts. Two suspected administrators were arrested in the UK as part of the operation.
ShinyHunters, Clop Feud Escalates, Threatens Broader Security Risks
The rivalry between Clop and ShinyHunters is heating up, with public defacements, bold demands, and technical claims that could have far-reaching consequences for past victims. These two extortion groups have distinct approaches, with Clop exploiting zero-day vulnerabilities and ShinyHunters taking a different tack.
[SPONSOREDNUBIVANCE]
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
North Korean Hackers Infect 30,000 Devices in Global Cyberattack
In a massive global cyberattack, North Korean hackers infected a staggering 30,000 devices across over 100 countries, siphoning off a whopping $10.7 million in cryptocurrency. The brazen heist, which ran from December 2025 to July 2026, also compromised over 7,000 cryptocurrency wallets.
D-Link Routers Expose Zero-Day Flaw to Remote Attacks
D-Link routers are under threat from a zero-day flaw that lets hackers launch remote attacks without needing login credentials, simply by sending specially crafted DHCP packets. This vulnerability can cause the device's DHCP daemon to crash or allow attackers to execute malicious code, putting your data at risk.
Microsoft Defender Zero-Day Blocks Antivirus Updates
A security researcher just released a clever tool called BigDiskBuster that can block Microsoft Defender updates, leaving your antivirus stuck in limbo. This sneaky proof-of-concept allows anyone to prevent Defender from getting the latest signature and platform updates, as long as the tool is running in the background.
AI Fuels 300% Surge in Bot Traffic, Exposes Enterprise Vulnerabilities
Last year, bot traffic skyrocketed by 300% thanks to AI, leaving enterprises vulnerable to automated threats. This alarming surge, driven by generative tools, puts commerce at the forefront of the crosshairs, with retailer systems and transactions under relentless attack.
SideCopy Targets Indian Academia with ReverseRAT Spear-Phishing
SideCopy, a notorious Pakistani threat actor, has set its sights on Indian academia with a cunning spear-phishing campaign, marking a tactical shift from its previous targets of government and defense forces. Using malicious scripts to evade security protocols, this group is now compromising academic institutions in India.
North Korea Targets 30,000 Devices in Global Crypto Heist
North Korean hackers have launched a massive global crypto heist, compromising over 30,000 devices in more than 100 countries and stealing at least $10.71 million in cryptocurrency. This staggering cybercrime spree has been uncovered by a joint advisory from top cybersecurity agencies worldwide.
Fake LastPass Installer Exploits Microsoft Driver to Disable Antivirus Software
Beware of fake LastPass installers that can disable your antivirus software and steal your saved credentials. A convincing fake LastPass Authenticator page on GitHub tricked victims into downloading a malicious ZIP archive that paved the way for a password stealer.
Ransomware Actors Exploit Active Directory Group Policy
In a clever twist, hackers used Active Directory Group Policy to spread ransomware across an entire domain without installing a single malicious file on individual computers. By exploiting this native tool, they were able to hijack wallpapers, lock screens, and even disable admin accounts, all with just a few clicks.