A major international crackdown led by US law enforcement has successfully disrupted the notorious Sality P2P botnet, a malware network that has been wreaking havoc for over two decades. On August 31, authorities from Bulgaria, Hungary, Romania, and the US joined forces with Europol and private-sector partners to seize key domains and dismantle the botnet's infrastructure.
In a chilling revelation, researchers have confirmed that Serbian student activists and government officials were targeted by the notorious Pegasus spyware, a tool still being used to silence democracy advocates. This disturbing discovery has exposed a sinister campaign that compromised the devices of 14 people, including a member of parliament and a local government official.
In a major cybercrime sting, law enforcement has dismantled a 23-year-old Russia-based botnet that had infected over 11 million devices worldwide. By cleverly tricking the network into cutting off access to its own devices, CrowdStrike rendered the notorious Sality botnet irrecoverable.
Hackers are actively exploiting a vulnerability in Sangoma Switchvox, CVE-2026-9586, to gain unauthorized access and deploy reverse shells on vulnerable devices, with around 4,000 exposed devices, mostly in the US, at risk. This security flaw allows attackers to inject malicious SQL code, making it crucial to update to Switchvox version 8.4.0.2 to prevent exploitation.
A sneaky malware campaign has been disabling Windows Update and weakening Defender, compromising multiple organizations and industries worldwide, with a focus on China-based operations and Chinese-speaking users. The culprit behind this malicious activity is linked to a Chinese threat cluster known as Silver Fox, or Yinhu.
In a chilling display of efficiency, AI-powered agents automated a ransomware attack on an enterprise network in under 10 hours - a process that would typically take human operators two weeks to complete. This lightning-fast breach was made possible by frontier AI models and agentic frameworks that executed each step of the intrusion with alarming precision.
Hackers are actively exploiting two zero-day vulnerabilities in SonicWall's Secure Mobile Access (SMA) Series 1000 appliances, potentially allowing unauthorized access to sensitive functionality and malicious operations. This critical threat has prompted SonicWall to warn users of its SMA1000 boxes to take immediate action.
Hackers are actively exploiting a critical flaw in JFrog Artifactory, CVE-2026-82329, to gain admin access and forge tokens, putting your entire system at risk. This authentication bypass vulnerability can allow attackers to elevate their permissions and automatically gain access to trusted and sensitive data.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
A massive malware campaign targeting nearly 80,000 freelancers worldwide has led to the extradition of a Russian national, Searzhudin Tamirlanovich Aktulaev, who faces charges of conspiracy, computer damage, and identity theft. Aktulaev's alleged crimes, committed between 2016 and 2017, have finally caught up with him after an international arrest and extradition.
Meet StreamRat, a sneaky new Android banking trojan that's giving hackers near-total control over infected devices - and it's been spreading through paid social media ads on Meta. This sophisticated threat is a major red flag for Android users, especially in Spain where the campaign was focused.
A recent BGP hijack attack targeted users of Virtualizor with malware that granted persistent root access, affecting a limited number of servers that received rerouted Softaculous update traffic during a 33-hour window. The attackers cleverly obtained a valid Let's Encrypt certificate, making the malicious server appear trustworthy to clients.
Brazilian government websites have been hijacked by malicious actors, redirecting traffic to betting sites in a sneaky campaign attributed to a Chinese-speaking cluster known as Gambling Goblin or Earth Berberoka. This multilingual scheme has been cleverly manipulating search engines and government systems since mid-2025.
Researchers have uncovered a shocking vulnerability in seven AI coding agents, where malicious Git configurations can trick the tools into running attacker-supplied code on a developer's machine. This flaw, linked to Git's core.fsmonitor setting, has already led to eight security flaws, with four still unpatched.
Meet Gambling Goblin, a Chinese-speaking cybercrime cluster that's been secretly hijacking Brazilian government and education websites to fuel a massive SEO fraud campaign since mid-2025. They're using sneaky Apache modules to disguise their malicious activity and stay under the radar.
MSPs are under siege from ransomware attacks, with 143 reported victims in 2025 alone, and it's clear that a robust defense requires more than just backup or endpoint detection - a comprehensive, integrated protection approach is needed. To stay safe, MSPs must bring together prevention, detection, response, and recovery into a cohesive, measurable service that delivers six critical outcomes.
In a recent ransomware attack, a human attacker used AI to breach an enterprise network in under 10 hours - compressing weeks of meticulous planning into a lightning-fast operation. This was achieved by leveraging autonomous agents that worked in parallel, methodically bypassing security layers to achieve a shared goal.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deployment
A massive malware campaign, involving around 255 fake accounts and 80,000 targeted users, has led to charges against a Russian national, Searzhudin Tamirlanovich Aktulaev, who has been extradited and charged by the U.S. Department of Justice. The campaign, which spread malware through infected Excel attachments, allegedly ran from June 2016 to November 2017, targeting freelancers and others.
A massive phishing campaign infected 80,000 freelancers with malware, using 255 fake accounts to spread malicious Excel attachments with hidden macros that downloaded additional software onto victims' systems. The cleverly designed scam exploited a popular freelance employment platform's online messaging feature to spread its digital damage.
In a major win for national security, authorities have successfully dismantled the Sality malware's peer-to-peer network, crippling its ability to spread and cause harm. By cleverly turning the malware's own protocols against it, law enforcement and private partners isolated infected hosts and rendered the threat actor powerless.
In a major win for cybersecurity, global authorities have joined forces to dismantle the notorious Sality botnet infrastructure, seizing key domains in the US and Europe. This coordinated crackdown, involving the US Department of Justice and international partners, has disrupted the malware's grip on thousands of infected computers.
In a major win for cybersecurity, CrowdStrike and international law enforcement agencies joined forces to dismantle the notorious Sality botnet, crippling its ability to communicate and operate by corrupting its core network. By targeting the botnet's peer list, they effectively isolated infected machines and brought the 23-year-old threat to a grinding halt.
Beware of a sneaky phishing scam that's targeting high-profile individuals, using a clever tactic to gain long-term access to their cloud accounts without needing their passwords. This sophisticated attack convinces victims to grant a malicious app permission to their accounts, allowing hackers to stay logged in for good.
Cyber attackers are leveraging a newly exploited Artifactory flaw in highly sophisticated, AI-driven campaigns - but are these threats coming from automated bots or human culprits? The line between human and machine is blurring in the world of cybercrime.
Hackers are using clever phishing lures disguised as invoices and business files to trick victims into installing malicious software, with over 457 endpoints compromised in just a month. They exploited a legitimate endpoint-management tool to gain remote control and install additional remote-access software.