[SPONSOREDNUBIVANCE]
Rapid7 deployed right the first time.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deploymentMalware & Ransomware
FortiBleed Campaign Exploits FortiGate Devices to Harvest Credentials
A massive cyber operation, known as FortiBleed, has been secretly targeting over 430,000 FortiGate firewalls worldwide since February 2026, allowing hackers to harvest and crack sensitive VPN and authentication credentials on a huge scale. This alarming campaign has enabled large-scale credential harvesting, putting countless online security systems at risk.
WhatsApp VBScript Campaign Targets Global Users with RMM Software
Malicious actors are targeting WhatsApp users worldwide with a sneaky VBScript campaign, compromising accounts to spread harmful files through direct messages. In a shocking concentration of attacks, 80% of victims were in Malaysia, highlighting the need for users to stay vigilant.
Ransomware Gang Disables Security Software with GentleKiller Framework
Meet GentleKiller, a sneaky framework that helps ransomware gangs disable security software by targeting over 400 processes across 48 security products at the kernel level, allowing them to run unchecked. This sinister tool uses a "bring your own vulnerable driver" technique to terminate protections and clear the way for ransomware attacks.
Threat Actors Monetize Stolen Credentials with Searchable Underground Services
Cybercriminals are cashing in on stolen credentials with a new breed of underground services that allow buyers to search and purchase specific, verified login details. This emerging market acts as a middleman between hackers who steal sensitive info and those who want to use it to take over accounts.
Malicious Google Ads Deliver CastleStealer via New OXLOADER Malware
Beware of malicious Google ads that can deliver CastleStealer via the new OXLOADER malware, which has shown impressive engineering skills and is worth keeping an eye on. Victims are tricked into downloading fake Node.js versions through ads masquerading as legitimate sources.
FortiBleed Campaign Exposes 80K Targets Worldwide
A massive cybersecurity threat, dubbed FortiBleed, has exposed over 80,000 Fortinet FortiGate devices worldwide, with alarming ease, by exploiting weak passwords and reused credentials. The US Cybersecurity agency is urging affected customers to secure their appliances immediately to prevent a potential breach.
Canada's Spy Agency Neutralizes Foreign Botnets with Landmark Warrant
In a groundbreaking move, Canada's spy agency, CSIS, has successfully neutralized two foreign-run botnets operating on Canadian soil, thanks to a landmark warrant that allowed them to access and shut down infected devices. This pioneering threat-reduction tactic marks a major win in the fight against botnet threats.
Gizmodo Readers Targeted by ClickFix Malware After Account Compromise
If your Gizmodo account was compromised, be aware that you may have been targeted by the ClickFix malware, which showed up as suspicious prompts after the breach. Stay vigilant and take immediate action to protect your online security!
AryStinger Malware Infects 4,300 Routers in Global Reconnaissance Network
Meet AryStinger, a sneaky new malware that's hijacked over 4,300 home routers worldwide, transforming them into a covert network for spying and proxying - and the numbers are still climbing. This cunning malware lets hackers scan the internet, tunnel traffic, and run secret commands, all while hiding their digital tracks.
AryStinger Botnet Exploits Flaws in Thousands of D-Link Routers
Meet AryStinger, a sneaky botnet that's hijacked over 4,000 outdated D-Link routers worldwide, turning them into a powerful tool for hackers to carry out stealthy scans and attacks. This malware mastermind breaks down massive tasks into tiny chunks, distributing them across its zombie network for lightning-fast execution.
Prinz Eugen Ransomware Targets Critical Files in Hands-On Attacks
Meet Prinz Eugen, a sneaky ransomware that uses hands-on tactics to target critical files, evading detection by deliberately leaving no ransom note behind. Its operators use stolen RDP credentials and remote monitoring tools to manually infiltrate and take control of systems.
Credential Attacks Target Fortinet, Sophos, MSSQL Devices in Large-Scale Campaign
A large-scale password spraying and credential theft campaign, dubbed "FortiBleed," is targeting Fortinet devices, with attempts also seen against MSSQL services and Sophos devices, warns Unit 42. This coordinated attack has sparked concerns over widespread credential attacks.
Hackers Exploit Gravity SMTP Plugin Bug on 100,000 WordPress Sites
A critical bug in the Gravity SMTP plugin is being exploited by hackers on over 100,000 WordPress sites, putting sensitive information at risk. Update to version 2.1.5 or later to patch the vulnerability.
Gentlemen Ransomware Targets 400 Security Processes with GentleKiller EDR Framework
Meet GentleKiller, a sophisticated EDR-killer framework used by The Gentlemen ransomware-as-a-service operation to evade detection by targeting 400 security processes from 48 distinct programs. This framework comes in eight variants, each designed to mimic a legitimate product and exploit a vulnerable driver.
CISA Warns of Widespread FortiBleed Attacks on 86,644 Devices
The US Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning after a massive cyberattack, dubbed FortiBleed, compromised a staggering 86,644 FortiGate devices, putting countless networks at risk. Take immediate action to protect yourself: shut down active SSL VPN and admin sessions, reset passwords, and enforce strong password policies.
Law Enforcement Disrupts SocGholish Malware Network, Cleans 15,000 WordPress Sites
In a major win for cybersecurity, an international team of law enforcement agencies has dismantled a notorious malware network, freeing 15,000 WordPress sites from infection and dealing a significant blow to cybercriminals. This decisive action is just the beginning, with authorities vowing to continue the fight against botnets and cybercrime.
[SPONSOREDNUBIVANCE]
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverage
Operation Endgame Disrupts SocGholish Malware Network
In a major win for global cybersecurity, Operation Endgame has successfully dismantled a significant portion of the SocGholish malware network, depriving cybercriminals of access to thousands of infected computer systems and preventing further damage to citizens, businesses, and organizations worldwide. This decisive action has already remediated 15,000 compromised websites and taken down 106 key infrastructure nodes.
CISA Warns Fortinet Users of Credential Exposure After FortiBleed Leak
Fortinet users are being warned by CISA to take immediate action to protect themselves from credential exposure after a massive leak, known as FortiBleed, exposed nearly 74,000 firewall and VPN credentials. Take steps now to secure your devices and prevent malicious cyber actors from exploiting your compromised credentials.
Authorities dismantle Evil Corp's SocGholish botnet infrastructure
In a major win for cybersecurity, international authorities have joined forces to dismantle the notorious SocGholish botnet infrastructure, a multi-stage malware kit that had been exploited for ransomware campaigns and espionage since 2017. This coordinated effort has successfully disabled the malware's control points and seized related infrastructure.
Gentlemen Ransomware Targets EDR Defenses With Suite of Killers
Meet GentleKiller, a powerful tool used by Gentlemen ransomware to disable EDR defenses by targeting over 400 processes from 48 security vendors, allowing for smooth data theft and encryption. This sneaky utility relies on the bring your own vulnerable driver (BYOVD) technique to outsmart security engines.
NetNut Exposed in Massive Popa Botnet Operation
Meet Popa, a sneaky Android-based plugin that's been secretly infiltrating over 1.4 million internet addresses via unofficial streaming apps and set-top devices, researchers have uncovered. This stealthy operation is linked to the notorious Vo1d botnet family, which has been targeting vulnerable Android TV boxes.
Malware Developers Embed Deceptive Code to Evade AI Analysis
Malware developers are getting sneaky, hiding deceptive code in their spyware to throw off AI analysis - and it's working, with one developer adding text about nuclear and biological weapons to their malicious software. This clever trickery tricks AI systems into ignoring the real threat.
Cyber Trust Erodes as AI, Tools Enable New Attacks
Trust is crumbling in the digital world as hackers exploit AI and tools to launch devastating attacks, turning trusted platforms into malware delivery mechanisms. The latest threat: hijacked Google Ads and AI developer tools used to funnel over 2,000 victims to malicious download pages.
Chinese Hackers Infiltrate Defense Research with Custom Malware
Chinese hackers have launched a stealthy attack on defense research using custom malware, embedding it into upgrade workflows so it survives even when vulnerabilities are patched. This allows the malware to re-infect new versions, making it a persistent and concerning threat.