[SPONSOREDNUBIVANCE]
Know a small business winging it on security?
No IT department, no security budget, real exposure. Nubivance builds right-sized security foundations for small companies. Send them this.
Send it alongMalware & Ransomware
Typosquatting Campaign Targets RubyGems Users with Windows Stealer
Beware of a sneaky typosquatting campaign targeting RubyGems users: 16 malicious packages were used to spread a Windows stealer that harvests sensitive data, including browser credentials, cryptocurrency wallets, and Telegram info. This malware can strike when you least expect it, putting your online security at risk.
Ransomware Attacks Singly Target Mid-Market Firms
Ransomware attacks are hitting mid-market firms with alarming frequency, and the threat is only escalating as AI-powered tools rapidly uncover new vulnerabilities at an overwhelming pace. Mid-market companies, with revenues between $10m and $1bn, now account for nearly three-quarters of ransomware attack victims.
Ransomware gangs exploit Windows Task Host flaw
Ransomware gangs are exploiting a high-severity flaw in Windows Task Host, a core component that could allow them to escalate privileges and wreak havoc on your system. This vulnerability, already patched by Microsoft, poses significant risks to users, especially those with basic user permissions.
Hackers Exploit Public Wi-Fi DNS to Harvest Credentials
Beware of hackers lurking on public Wi-Fi networks at hotels, conference centers, and other hotspots, who are using a sneaky trick to steal your login credentials by hijacking the network's DNS settings. By changing just one setting, they can redirect you to fake login pages that look legit - and that's all they need to get their hands on your sensitive info.
BlackFile Targets Financial Firms in Ongoing Extortion Campaign
Financial firms are under attack by a relentless extortion group called BlackFile, which has been targeting the sector with alarming persistence since the start of the year. This threat actor has also set its sights on other industries, including med tech, with no signs of slowing down.
Iranian Hackers Evolve Cavern C2 with Google Apps Script Evasion
Meet the sneaky new tactic Iranian hackers are using to evade detection: blending malicious traffic with everyday services like Google Apps Script. By leveraging DNS A-record responses, they're able to switch between direct HTTPS channels and Google Apps Script relays, making it harder to track their moves.
UNISOC Modem Flaw Enables Remote Code Execution
A newly discovered flaw in UNISOC modem firmware can be exploited to execute arbitrary code with kernel privileges, allowing hackers to gain deep access to Android devices. Simply making a video call to a vulnerable phone can trigger the attack.
China APT Exploits VMware Flaw in Targeted Attacks
A recent investigation revealed that a suspected China-nexus APT group is actively exploiting a critical VMware vCenter vulnerability, CVE-2026-59310, to execute arbitrary code and deploy a backdoor, with ransomware seemingly used as a smokescreen to distract from the underlying intrusion. The attackers' true intentions appear to go beyond mere ransomware deployment.
Unisoc Exploit Chain Grants Attackers Full Android Kernel Access
Security researchers have uncovered a two-stage exploit chain that can give attackers full access to the Android kernel on devices using Unisoc modem firmware, and alarmingly, the vendor has remained unresponsive to disclosure efforts. This chain can be triggered by a simple malformed video call, putting countless devices at risk.
Clop Ransomware Targets GE, Philips in Data Theft Attacks
Major companies like Philips, General Electric, and Shell are investigating claims by the Clop ransomware gang that their systems were breached, with Philips confirming a contained breach of an internal server that didn't affect customers. The incidents are a stark reminder of the growing threat of ransomware attacks on businesses.
Apple Alerts 110 Countries to Mercenary Spyware Threats
Apple just sounded the alarm for users in 110 countries, warning them they've been targeted by highly sophisticated mercenary spyware attacks that are among the most advanced digital threats out there. This latest alert is part of a multi-year effort to protect users, with notifications now sent to customers in over 150 countries.
Mustang Panda Upgrades CoolClient Backdoor with Signed Windows Rootkit
Meet the upgraded CoolClient backdoor, now armed with a signed Windows rootkit that lets it hide in plain sight, and a closer look reveals it's linked to the notorious HoneyMyte threat group, aka Mustang Panda. This sneaky malware has been targeting victims in Myanmar, Mongolia, Pakistan, and more.
Hackers Exploit Dropcatch Domains to Redirect Traffic to Scams and Malware
Hackers are exploiting "dropcatch domains" - previously owned domains that are re-registered by new owners - to redirect traffic to scams and malware, taking advantage of the reputation and connections they inherit from their past life. With nearly one in five new domain registrations being a re-registration of an expired name, the threat is more widespread than you might think.
macOS Screen Sharing Flaw Exploited to Install Monero Miner
Apple just released emergency updates to fix a critical flaw in macOS Screen Sharing that hackers were using to secretly install Monero miners on vulnerable Macs. The updates, available for macOS Tahoe, Sequoia, and Sonoma, patch a vulnerability that allowed attackers to bypass authentication and gain unauthorized access.
SAP Exploits Maximum-Severity Commerce Cloud Flaw in Active Attacks
SAP Commerce Cloud has a critical vulnerability, known as CVE-2026-58231, that allows unauthenticated attackers to wreak havoc by executing arbitrary code and compromising internal components. This maximum-severity flaw, scoring a perfect 10.0 on the CVSS scale, stems from weak authorization checks and input validation.
China-nexus APT Exploits VMware Flaw to Deploy Ransomware
A China-linked APT group has been exploiting a recently patched VMware vCenter vulnerability to deploy ransomware in a widespread campaign that hit 361 victims across 47 countries. The attackers used the flaw to gain root access and, in some cases, installed a Babuk-derived ransomware that locks files with a ".babyk" extension.
[SPONSOREDNUBIVANCE]
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverage
Evooo1Bot Linux Botnet Exploits Flaws to Hijack Edge Devices as SOCKS5 Proxies
Meet Evooo1Bot, a sneaky new Linux botnet that's been quietly hijacking edge devices since July 2026, turning them into SOCKS5 proxies by exploiting known vulnerabilities. This cunning botnet is built on the Mirai codebase, but with a range of upgraded capabilities that make it a formidable foe.
Infostealers Harvest 1.7 Billion Credentials in Six Months
Cybercriminals have supercharged their credential-harvesting capabilities, with infostealer malware infecting 7.4 million devices and snagging a staggering 1.7 billion credentials in just six short months. This automated threat landscape redefines the speed and scale of a breach.
DDoS Attacks Disrupt Threema Secure Messaging Service
Threema, a popular secure messaging service, was hit by a massive disruption on Tuesday evening, initially attributed to a network outage at a colocation partner, but later revealed to be the result of large-scale DDoS attacks. The attacks caused significant interruptions to the service, affecting users worldwide.
AmnesiaStealer Malware Hijacks macOS Browser Sessions with Remote Control
This sneaky malware takes remote control of your macOS browser sessions, allowing hackers to live-stream your screen and even drive your cursor - all without you knowing. They can basically take the reins, controlling your keyboard, mouse, and navigation.
Evooo1Bot Malware Targets Routers in Global Traffic Relay Botnet
Meet Evooo1Bot, a sneaky malware that's turning routers worldwide into unwitting traffic relays, harvesting credentials, and launching devastating DDoS attacks. This modular Linux botnet is packed with powerful tools, including encrypted communication, SSH brute-forcing, and exploit arsenals to take down vulnerable devices.
HoneyMyte APT Group Upgrades CoolClient Backdoor with Kernel-Level Rootkit
Meet the upgraded CoolClient Backdoor, now packing a kernel-level rootkit courtesy of the sneaky HoneyMyte APT Group - and it's hiding in plain sight with a legit digital signature. This clever malware uses a Windows service and a kernel-mode driver to evade detection.
Hackers exploit macOS flaw to deploy Monero miners
Hackers are exploiting a recently fixed macOS security flaw to secretly deploy Monero miners, and experts warn that public exploit code is now available, putting users at risk. This vulnerability, affecting macOS's built-in Screen Sharing feature, allows attackers to gain access without valid credentials.
Autonomous AI Attacks Target Critical Infrastructure
The threat of autonomous AI attacks on critical infrastructure is no longer a distant possibility, but a looming reality that could unleash devastating kinetic disasters, warns Tom Kellermann, VP of AI security and threat research at TrendAI. The perfect storm of rising geopolitical tension and increasingly powerful off-the-shelf AI agents makes a crippling attack on our infrastructure not just plausible, but imminent.