[SPONSOREDNUBIVANCE]
Know a small business winging it on security?
No IT department, no security budget, real exposure. Nubivance builds right-sized security foundations for small companies. Send them this.
Send it alongMalware & Ransomware
Microsoft 365 Phishing Attacks Expose Data Theft Tactics
Microsoft warns that cyber attackers are using clever social engineering tactics, like impersonating IT help desks, to trick employees into spilling sensitive info and gaining access to Microsoft 365 accounts. These scammers do their homework, researching companies and staff on social media and professional networks to make their attacks convincing.
Artifactory Flaws Exploited to Deploy Rust Backdoor Malware
Security researchers have uncovered a sneaky attack that uses two flaws in JFrog Artifactory to deploy a custom Rust backdoor malware, giving hackers full control of self-hosted servers. This stealthy exploit chain lets attackers escalate from low privileges to admin control, even when anonymous access is disabled.
Anthropic Disrupts Russian Hackers' AI-Driven Malware Rebuild Efforts
Anthropic has successfully disrupted the AI-driven malware rebuild efforts of Russian hackers, dealing a significant blow to their operations. The hackers had been using AI to refine their malware and evade detection by security defenses.
Anthropic Exposes AI-Driven Cyber Threats
Cybercriminals and state-sponsored hackers have exploited AI tools for malicious activities like cyber attacks, propaganda, and mass surveillance, according to a report by Anthropic. The company's research uncovered dozens of alarming campaigns, revealing a new era of AI-driven threats.
Threat Actors Exploit Trusted AI Platforms to Deliver Malware
Beware: hackers are exploiting trusted AI platforms by turning their helpful features against you, using tactics like shareable AI content and sponsored search results to deliver malware and hold your files hostage. Your trusted tools can quickly become a vulnerability, as threat actors find new ways to abuse the very features you rely on.
Hackers Exploit M365 Feature in Targeted Phishing Campaign
KnowBe4's Threat Lab team uncovered a massive phishing campaign, detecting 29,785 confirmed phishing emails that exploited Microsoft 365's Direct Send feature over just two months. The attacks followed a surprisingly human pattern, spiking on Mondays and Tuesdays during US business hours.
Ukrainian Lawyer Turned Conti Coder Gets 4-Year Sentence
Meet Oleksii Oleksiyovych Lytvynenko, a Ukrainian lawyer-turned-ransomware coder who traded in his law books for a life of cybercrime as a key player in the notorious Conti operation, and ultimately paid the price with a four-year prison sentence. He was caught funneling thousands of dollars in cryptocurrency to his co-conspirators, including a $25,042 transfer that sealed his fate.
Cisco FMC Exploits Fuel Ransomware, Credential Theft
Cisco is urging customers to apply hotfixes immediately to protect against ransomware and credential theft attacks exploiting vulnerabilities in its Secure Firewall Management Center (FMC) software. The company has already released patches for the affected versions and plans to roll out additional security updates soon.
PaperCut Fixes Actively Exploited Flaws with New Security Releases
PaperCut has released new security updates to fix two actively exploited flaws that allowed hackers to bypass authentication and execute malicious code, with over 395 organizations in 48 countries affected. The company has issued maintenance releases, including versions 26.0.5, 25.0.13, and 24.1.10, to patch the vulnerabilities and protect users.
China-Linked Hackers Exploit Sogou Input Flaw to Deploy GRAYRABBIT Backdoor
A single malicious link was all it took for China-linked hackers to gain control over millions of users of the popular Sogou Input Method, a vulnerability that highlights the power of a tiny flaw in a widely-used tool. The attack, attributed to UNC3569, used a specially crafted link to deploy the GRAYRABBIT backdoor, putting hundreds of millions of users at risk.
Attackers Exploit JFrog Flaws to Seize Admin Control
Cyber attackers have found a way to chain two JFrog Artifactory flaws, CVE-2026-42018 and CVE-2026-42016, to gain administrator control of self-hosted instances, putting your sensitive data at risk. This alarming exploit was recently reported by cloud security company Wiz.
AI Enables Small Actors to Launch Sophisticated Hacking Campaigns
Meet JackPoterz, a small but sophisticated actor who leveraged AI to launch a hacking campaign that mirrored Russian state espionage tactics, and six other malicious groups who similarly misused AI models for cyber operations, influence campaigns, and more. Anthropic's investigators successfully disrupted each operation, but the incident highlights the growing threat of AI-enabled hacking.
Conti Ransomware Operative Draws Four-Year Prison Sentence
A Ukrainian national has been sentenced to four years in prison for his role in the notorious Conti ransomware campaign, a significant blow to cybercrime after a cross-border prosecution effort. He was caught in Ireland in 2023 with a laptop running Cobalt Strike, and later extradited to the US to face charges.
US Justice System Targets Conti Ransomware Operative with 4-Year Sentence
In a major win for cybersecurity, a Ukrainian national has been sentenced to four years in prison for his role in the notorious Conti ransomware attacks that hit 47 states and 31 countries, causing over $150 million in estimated damages. Oleksii Lytvynenko, 44, pleaded guilty to conspiracy to commit wire fraud and was extradited to the US to face justice.
Anthropic Exposes AI-Powered Cyberattacks and Bioweapons Research
Criminals are now using AI to supercharge their cyberattacks, with a recent report revealing that AI agents performed nearly all the work in a series of automated break-ins and data heists. A Russian espionage group, known as GTG-20006, used AI to accelerate its intrusions, targeting over 20 organizations in a sustained campaign.
Android Malware Mantax Otax Encrypts Devices, Steals Data, and Harasses Victims
Beware of Mantax Otax, a sneaky Android malware that's encrypting devices, swiping sensitive data, and even harassing victims - all thanks to clever tricks by Indonesian operators who are using sideloaded APKs to spread the threat.
[SPONSOREDNUBIVANCE]
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverage
AI Agents Fuel Rapid PaperCut Attacks on 395 Organizations
In a stunning display of speed, hackers used AI agents to exploit PaperCut vulnerabilities, compromising at least 11 organizations in just 26 seconds and gaining domain admin access in a mere two hours. This rapid, automated campaign hit 395 organizations across 48 countries, leaving a trail of destruction in its wake.
Cisco FMC Exploits Fuel Ransomware, APT Attacks
Cisco FMC vulnerabilities are being exploited by threat actors, including state-sponsored groups and crimeware attackers, to fuel ransomware and advanced persistent threat (APT) attacks. These bad actors are using recently patched flaws to gain initial access, run scripts as root, and escalate privileges.
AI-Powered Attack Exploits PaperCut Flaws in 395 Organizations
In a shocking display of speed, an AI-powered attack exploited PaperCut flaws to compromise at least 11 organizations in just 26 seconds, with the entire campaign unfolding in a matter of hours. The attackers used "hundreds of AI agents" to automate the exploitation effort, combining AI models with commodity tools to target vulnerable PaperCut NG/MF servers.
Google Play Exposed to Deceptive App Abuse
A sneaky app, "Vice Streets: Open World", racked up over 1 million downloads on Google Play without a single public review or rating, taking advantage of the platform's Early Access feature. This feature, meant to help developers gather feedback, can also shield them from criticism - and warn signs - that might scare off users.
BlueMoon Exploit Kit Targets Windows, Chrome with Zero-Day Flaws
Meet BlueMoon, a sneaky exploit kit that's been wreaking havoc on Windows and Chrome since August 28, using not one, not two, but three zero-day flaws to do its dirty work. This malicious tool, linked to the JungleBamboo threat actor, combines browser vulnerabilities with a Windows kernel exploit to gain ultimate control.
Gigabud Trojan Exploits Android Work Profiles to Evade Banking App Malware Checks
The sneaky Gigabud Trojan is exploiting Android work profiles to slip past banking app security checks, allowing it to secretly tamper with transactions and drain accounts. By creating a separate work profile, Gigabud can hide in plain sight and facilitate fraudulent payments that appear legitimate.
AI Agents Fuel PaperCut Attacks at Scale
A suspected Russian-speaking actor has unleashed a massive assault on PaperCut MF/NG, compromising at least 440 instances with the help of hundreds of AI agents that supercharged exploit development, targeting, and post-exploit operations. The attacks hit the education sector hard, with victims in 48 countries, primarily in the US, UK, France, and other major nations.
MantaxOtax Malware Targets Android Devices with Ransomware and Spyware
Meet MantaxOtax, a sneaky malware that's putting Android users on high alert with its potent mix of ransomware and spyware, allowing hackers to hold your device hostage and snoop on your personal life. This hybrid threat can encrypt your files, track your location, and even siphon off sensitive info like contacts, call logs, and gallery content.