[SPONSOREDNUBIVANCE]
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageMalware & Ransomware
P7 DarkSword Exploit Kit Enhances iOS Data Theft Capabilities
Meet P7 DarkSword, a sneaky new iOS exploit kit that's taking data theft to the next level by shrinking its footprint, swiping sensitive info like keychain and crypto-wallet data right from your device. Its clever tactics include extracting data into JSON on your phone and using a two-way communication channel with its command center.
AhsayCBS flaws exploited to deploy webshells, crypto miners
Cyber attackers have struck at least five organizations by exploiting two unpatched flaws in the AhsayCBS backup management platform, using a clever two-step attack chain to gain access and deploy malicious code. By chaining these vulnerabilities, the attackers were able to quickly move from gaining access to taking control of the compromised systems.
Germany Seizes Alleged Qilin Ransomware Leader After Japan Extradition
In a stunning display of international cooperation, Japanese authorities detained a Russian national who arrived in the country as a tourist and subsequently extradited them to Germany to face charges related to the notorious Qilin ransomware. This joint effort between Japan and Germany marks a significant breakthrough in the fight against cybercrime.
Chinese Hackers Exploit AI-Powered Tool to Breach Korean Banks
Chinese hackers have breached South Korean financial institutions using an AI-powered tool, with CrowdStrike Intelligence uncovering evidence of exfiltrated data and a sophisticated campaign that went beyond mere reconnaissance. The alarming breach, active from late September to early October, highlights the growing threat of AI-fueled cyberattacks.
AhsayCBS Flaws Exploited to Deploy XMRig Miners
Hackers are exploiting weaknesses in AhsayCBS to spread XMRig cryptominers, using clever tactics like disguising malware as Microsoft Edge. They gain access by chaining two recently disclosed vulnerabilities, CVE-2026-105133 and CVE-2026-105134.
Exploit Published for AnyDesk Linux Flaw Granting Root Access
A recently discovered flaw in AnyDesk's Linux version has been exploited, allowing attackers to gain root access on vulnerable systems - and a working exploit, called AnyPwn, has even been published on GitHub. This security gap was initially downplayed by AnyDesk as a simple bug that could lead to a crash.
SonicWall SMA1000 flaw exploited in targeted attacks
A critical vulnerability, CVE-2026-102255, in SonicWall SMA1000 appliances is being exploited in targeted attacks, putting sensitive internal functionality at risk. This maximum-severity flaw allows remote attackers to manipulate the appliance and perform unauthorized operations.
Citrix Warns of Zero-Day Attack on Unpatched NetScaler Systems
Citrix is warning users of a zero-day attack targeting unpatched NetScaler systems, so if you haven't updated yet, now's the time to take action and protect your systems from potential harm.
Ransomware Attacks Soar to Record High in Q3 2026
Ransomware attacks have skyrocketed to a record high, with 2,627 claimed incidents in Q3 2026 - a 27% surge from the previous quarter and a 61% jump from the same period last year. This alarming trend signals a significant escalation of the threat landscape across all major sectors.
Cybercriminal Money Laundering Operation Exposed
Meet Oleg Korniev, a Ukrainian-Russian dual citizen who just pleaded guilty to masterminding a massive money laundering operation that relied on 15,000 US-based "money mules" to funnel over $14.7 million in stolen funds for cybercriminals worldwide.
Ransomware CEO Indicted for Pocketing Millions in Client Fees
Meet Zohar Pinhasi, the alleged ransomware scammer who pocketed millions by preying on vulnerable businesses, charging them hefty fees for a promised solution that didn't exist. His company, MonsterCloud, is accused of swindling hundreds of clients out of over $19 million, while only paying $8 million in actual ransom payments.
Leader of 764 Child Sextortion Group Pleads Guilty
A disturbing world where children are exploited for twisted entertainment has been exposed, with 21-year-old Prasan Nepal, aka "Trippy", pleading guilty to leading a notorious child sextortion group. He faces 15-30 years in prison for his role in the heinous crimes committed by the group.
FBI Disrupts Chinese Hacking Tools, Warns of PRC Spies Targeting Global Networks
The FBI has struck a blow against Chinese hackers, seizing seven web domains linked to a suite of hacking tools, including the notorious FishHub malware, which was used to target global networks, including roughly 20 Taiwanese universities. This malware was designed to facilitate phishing activity, allowing hackers to gain a foothold in vulnerable systems.
Ransomware Attack Targets Japan's IDCF Cloud, Disrupts Government Clients
A massive ransomware attack has hit Japan's IDCF Cloud, crippling services for 495 companies and local governments, with hackers claiming to have encrypted a staggering 3.6 PB of data. The breach, which began on October 7, forced IDCF Cloud to immediately shut down its East Japan Region 1 cluster to prevent further damage.
China-Linked Hackers Expose Email Portal With Stolen Data
Meet Integrity Technology Group, a China-based company with ties to the government that's been caught red-handed running a web portal that lets others snoop on stolen emails. The US and UK have already slapped sanctions on the company, but the details of its shady operation are only now coming to light.
Android Phones Ship with Embedded Malware
Thousands of low-cost Android phones from reputable manufacturers have been secretly harboring malware for two years, with affected devices found in over 150 countries worldwide. This sneaky malware, dubbed "Midnight Mimosa," has been embedded in the firmware of devices from brands like Doogee and Cubot, allowing it to rack up fraudulent impressions and clicks without detection.
[SPONSOREDNUBIVANCE]
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
Shai-Hulud Worm Compromises AI Platform Tensorlake
A malicious version of the Tensorlake SDK, downloaded around 12,000 times per week, was briefly infected with the Shai-Hulud worm, which could have allowed attackers to hijack credentials and sensitive data. Fortunately, the issue was quickly detected and resolved, with the package being pulled and updated to a safe version.
FakeGit Campaign Resurfaces, Spawns 17,610 Malicious GitHub Repos
In a shocking resurgence, the FakeGit campaign sprang back to life on October 4, hijacking 17,610 dormant GitHub repositories to deliver malware at an alarming rate of nearly 3,000 per hour. The attackers cleverly exploited existing repositories, needing to create zero new ones to unleash this massive threat.
AI-Powered Pentesting Tool Exploited in South Korean Financial Data Heists
Meet ARTEX, an AI-powered pentesting tool that was originally designed for learning and research, but was repurposed by hackers to steal sensitive data from South Korean financial organizations. In a shocking campaign, attackers used ARTEX to breach security and get away with valuable information.
UAC-0099 Deploys ASHVEIN RAT in Targeted Attacks on Ukrainian Government Personnel
Meet ASHVEIN, a sneaky new malware that's helping Russia-aligned hackers steal sensitive info from Ukrainian government targets - and hiding their tracks in clever, invisible ways. This .NET infostealer and remote access trojan is a master of disguise, blending credential theft, surveillance, and remote control features to fly under the radar.
Google Certificates Targeted in ccTLD Hijacks
Google thwarted a sneaky attack where hackers hijacked three country-code domains to obtain fake HTTPS certificates for several Google sites and other organizations, quickly blocking the unauthorized certificates through Chrome's emergency response system. The compromised domains included .gh, .sl, and .as, which were manipulated by attackers to gain DNS control.
Russia-Aligned UAC-0099 Refines MATCHBOIL Malware
The operators of UAC-0099, a group likely aligned with Russian interests, have been steadily refining their MATCHBOIL malware, making it a more potent tool for future attacks. This deliberate evolution shows a clear intent to evade detection and enhance the malware's flexibility.
Wazza Phishkit Targets US, EU, Australia with Multi-Stage Routing
Meet Wazza Phishkit, a sophisticated threat that's targeting banking, manufacturing, and government organizations across the US, Europe, and Australia with a multi-stage routing chain designed to evade detection. This engineered delivery system uses a series of checks to route visitors to its final lure, making it a complex and formidable phishing threat.
Chinese Hacker Exploits AI in South Korean Bank Data Heist
Meet the new face of cybercrime: AI-powered hacking. A Chinese hacker recently used agentic AI tooling, alongside traditional tactics, to pull off a massive data heist at a South Korean bank.