[SPONSOREDNUBIVANCE]
Rapid7 deployed right the first time.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deploymentMalware & Ransomware
Extortion Gang Exploits Corporate Networks with In-Person Visits
Meet UNC3753, a notorious extortion gang that's taking corporate hacking to a whole new level - from deceitful phone calls to in-person visits, where they show up at companies' doorsteps with thumb drives, targeting dozens of US banks, law firms, and professional services firms in just a few short months. Their tactics have evolved from fake emails to help-desk calls and now, brazen doorstep drop-offs.
Hackers Actively Exploit SolarWinds Serv-U Flaw to Crash Servers
SolarWinds has issued an emergency hotfix to address a critical flaw in its Serv-U file transfer product, which hackers are actively exploiting to crash servers with specially crafted POST requests. A denial-of-service vulnerability, tracked as CVE-2026-28318, can be triggered without authentication, posing a significant threat to users.
Malware Worms Infect npm Ecosystem in Dual Supply Chain Attacks
Meet IronWorm, a sneaky Rust-based malware that's infecting the npm ecosystem by scraping sensitive secrets from developers' machines and spreading through poisoned packages. This stealthy threat hides behind an eBPF kernel rootkit and communicates with its operators over Tor.
Chinese APT Exploits New Malware to Prolong Network Access
A Chinese-linked espionage group, tracked as UNC5221 or VerdantBamboo, exploited new malware to secretly maintain access to US networks for over 18 months, evading detection by blending in with legitimate traffic. The attackers used a sophisticated backdoor called Brickstorm to prolong their stay undetected.
ESET Exposes Android Spyware Asin Targeting Arabic Users
Malicious apps masquerading as legitimate tools have been targeting Arabic-speaking Android users, packing stealthy spyware capabilities that allow them to siphon off sensitive information. These fake apps, part of a spyware cluster called Asin, are being spread through fraudulent websites and social accounts.
US Gas Station Tank Gauge Systems Vulnerable to Ongoing Attacks
US gas stations are under cyberattack, with hackers exploiting vulnerable tank gauge systems to gain control and wreak havoc. A joint advisory from top US agencies is urging critical infrastructure organizations to secure their internet-exposed systems ASAP.
Hackers Exploit Everest Forms Pro Flaw to Compromise WordPress Sites
A critical vulnerability in Everest Forms Pro, affecting over 4,000 active WordPress installations, has been exploited by hackers to gain remote code execution, allowing them to take control of sites without authorization. A patch has been released, but sites remain at risk if not updated to version 1.9.13 or later.
FIFA World Cup Scams Explode Ahead of 2026 Kickoff
As the 2026 FIFA World Cup approaches, scammers are kicking off their own game, with over 4,300 fraudulent domains and countless ticket scams, counterfeit merchandise, and banking malware already in circulation. With ticket requests exceeding 150 million and millions of fans eagerly awaiting kickoff, attackers are cashing in on scarcity and anxiety.
Cisco SD-WAN Zero-Day Exploited in Targeted Attacks
Cisco is warning of a high-severity zero-day vulnerability in its Catalyst SD-WAN Manager that is being actively exploited, allowing attackers to gain root privileges and execute arbitrary commands. This critical flaw affects all deployment types and could put your network at risk if left unpatched.
PCPJack Hijacks Cloud Servers for Covert SMTP Relay Network
Security firm Hunt.io uncovered a sneaky operation where hackers known as PCPJack hijacked cloud servers worldwide, turning them into secret SMTP relays that pumped out spam every five minutes. The stolen servers, found in major cloud platforms like AWS, Google Cloud, and Azure, were quietly converted into spam-spewing machines.
Ransomware Gang Pink Exploits Helpdesk Calls to Steal Credentials
Meet Pink, a notorious ransomware gang that's exploiting helpdesk calls to steal sensitive credentials using clever tactics like vishing and IT impersonation. They're using these stolen secrets to exfiltrate valuable data from enterprise cloud storage and productivity systems, leaving victims with a tough choice: pay up or face the consequences.
Magecart Campaign Exploits Stripe to Host Stolen Payment Data
Meet the sneaky Magecart campaign that's exploiting Stripe to host stolen payment data, cleverly hiding its skimming code inside trusted domains like Google Tag Manager and Stripe's API. By using these legitimate-looking channels, the attack slips past security filters, putting online stores and customers at risk.
Cybercriminals Target FIFA World Cup 2026 with Sophisticated Scams
As the 2026 FIFA World Cup approaches, cybercriminals are gearing up to scam unsuspecting fans with sophisticated ticketing scams, counterfeit sites, and panic-inducing mechanics. Experts warn that this major event has become a prime target for cyberattacks, with thousands of fraudulent domains and fake Facebook ads already circulating.
Flaw in Claude Code GitHub Action Exposes Repositories to Hijacking
A security researcher discovered a logic hole in Anthropic's Claude Code GitHub Action that could let attackers hijack vulnerable public repositories with just a single opened GitHub issue. This flaw exploited broad read and write permissions, putting countless repositories at risk.
IronWorm Malware Infects 36 npm Packages in Supply-Chain Attack
Meet IronWorm, a sneaky Rust-based infostealer that's infected 36 npm packages, putting a wide range of sensitive credentials and secrets at risk of being harvested. This stealthy malware operates undetected, targeting everything from AWS and OpenAI credentials to cryptocurrency wallet files.
Malvertising Campaign Spreads FlutterShell Backdoor to macOS Users
macOS users beware: a sneaky malware called FlutterShell is spreading through malicious ads and infected desktop apps, allowing hackers to take control of your device and steal sensitive data. This stealthy backdoor can execute commands, access files, and even siphon off browser session info - all while masquerading as legitimate software.
[SPONSOREDNUBIVANCE]
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
Microsoft Warns AI Adoption Exposes Organizations to New Malware Threats
Microsoft's senior security researcher warns that the AI tools making our jobs easier can also be exploited by threat actors, highlighting a new and urgent risk for organizations to manage. As AI adoption grows, companies must recognize it as both a valuable asset and a potential attack surface that requires careful protection.
Hackers Exploit Gaps in Vulnerability Programs with Simplified Playbook
Meet Hercules, the mastermind behind a notorious underground tutorial that spills the beans on how to turn vulnerability exploitation into cold, hard cash. With a refreshingly blunt approach, Hercules breaks down the process into simple, actionable steps that even novice attackers can follow.
China-Linked TA4922 Expands Phishing Attacks Globally
Meet TA4922, a China-linked group rapidly expanding its phishing attacks worldwide, with a financially motivated agenda to infiltrate and exploit victim environments for data theft, fraud, and more. This threat actor is now targeting organizations globally, from the UK to Germany, Italy, and South Africa.
Hackers Infiltrate Stock Exchange Executive's Outlook Mailbox for Months
Hackers stealthily infiltrated a senior stock exchange executive's Outlook mailbox, maintaining months-long control of their computer by masquerading as legitimate software. The alarming breach, detected as early as October 10, 2025, allowed the intruder to operate with SYSTEM-level privileges, the highest level of Windows access.
Malware Sites Exploit Open-Source Tools in Google Search Results
Malicious websites are masquerading as legitimate open-source and freeware projects, expertly designed to deceive users into downloading malware. With fake portals that mimic trusted sites, complete with real GitHub links and references to upstream resources, it's easy to get caught off guard - until you click that download button.
Free AI Models Enable Low-Cost, Sophisticated Cyberattacks
Experts warn that free AI models are making sophisticated cyberattacks more accessible and affordable, posing a vastly underestimated threat to security. Even relatively simple AI models can be used to launch devastating attacks, according to University of Toronto computer engineering professor Nicolas Papernot.
Hackers Exploit Active Directory Flaw to Harvest Passwords
Storing passwords in Active Directory description fields is a rookie mistake that hackers are eager to exploit, and one hacker did just that with alarming ease. It was disturbingly simple for them to get their hands on sensitive information.
Europe Cracks Down on Illegal Streaming Networks, Arrests 29
Behind the scenes of cheap streaming deals, complex crime networks are at work - but thanks to Operation Kratos 2, 29 alleged cybercriminals have been arrested and nine organized crime groups dismantled. This major crackdown on illegal streaming networks marks a huge win for European law enforcement.