[SPONSOREDNUBIVANCE]
Rapid7 deployed right the first time.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deploymentMalware & Ransomware
Apache ActiveMQ Vulnerability Exploited, Hits 6,400 Servers
More than 6,400 publicly accessible Apache ActiveMQ servers are under attack, thanks to a high-severity code injection vulnerability that's being actively exploited. Is your server among them?
Former Ransomware Negotiator Pleads Guilty to BlackCat Attacks
A former expert who was paid to negotiate with cybercriminals has taken a shocking turn, pleading guilty to participating in high-profile BlackCat ransomware attacks on US companies. Angelo Martino, a 41-year-old ex-incident responder, admitted to his role in the 2023 attacks.
NGate Malware Exploits HandyPay App to Steal Android NFC Payment Data
Malicious NGate malware has been discovered hiding inside a fake version of the HandyPay app, putting Android users' NFC payment data at risk. This sneaky malware exploits a trusted payments tool to steal sensitive information, leaving users vulnerable to financial theft.
Lazarus Group Targets KelpDAO in $290m Crypto Heist
In a shocking crypto heist, North Korea's notorious Lazarus Group is accused of swiping $290 million from KelpDAO, raising questions about accountability in the digital age. This brazen theft is a stark reminder of the threats lurking in the shadows of the cryptocurrency world.
Malware Disguised as Roblox Cheats Fuels Vercel Breach
Malware masquerading as Roblox cheats sparked a chain reaction, leading to a significant security breach at Vercel and exposing vulnerabilities in modern cloud and SaaS ecosystems. This incident highlights how a seemingly harmless piece of malware can wreak havoc across connected services.
Lazarus Hackers Orchestrate $290 Million KelpDAO Heist
In a shocking turn of events, the Lazarus hackers struck again, making off with a staggering $290 million from the KelpDAO decentralized finance project in a single weekend heist. But who benefits from this massive theft, and who's left to deal with the devastating aftermath?
Malicious Apps Infiltrate Apple's China Store, Target Crypto Wallets
Scammers have infiltrated Apple's China App Store with 26 fake cryptocurrency wallet apps, cleverly disguised as popular wallets like Metamask and Coinbase, to steal sensitive recovery phrases and drain users' digital assets. These malicious apps put unsuspecting crypto investors at risk of losing their hard-earned money.
Gentlemen Ransomware Gang Taps SystemBC for Botnet Attacks
Imagine your business's infrastructure being hijacked and turned into a fleet of malicious proxies - it's a harsh reality that's now hitting home for over 1,570 corporate victims who've fallen prey to the Gentlemen ransomware gang's SystemBC botnet attacks. Their compromised systems are being used to run proxy services for the malware, leaving defenders scrambling to respond.
SGLang Flaw Enables Remote Code Execution via Malicious Model Files
A single malicious file can become a powerful gateway for attackers to run arbitrary commands on vulnerable machines - and a newly disclosed flaw in SGLang, CVE-2026-5760, reveals just how easily this can happen through specially crafted GGUF model files. This highly severe vulnerability, scoring 9.8 out of 10.0, enables remote code execution on systems that trust it.
Malicious iOS Apps Expose Crypto Users to FakeWallet Threat
Beware of scammers on the official app store: over 20 fake cryptocurrency wallet apps were recently discovered on the Apple App Store, masquerading as legit software to steal user credentials and secrets. These malicious apps, dubbed FakeWallet, put unsuspecting crypto users at risk of losing their digital assets.
Scotland's Scattered Spider Affiliate Pleads Guilty in US Cryptocurrency Heist
A Scottish affiliate of the notorious Scattered Spider cybercrime crew has pleaded guilty in the US to stealing at least $8 million in cryptocurrency through a cunning phishing and SIM-swap scheme. This guilty plea raises a pressing question: what can $8 million buy in the shadowy world of digital theft?
ZionSiphon Malware Targets Water Infrastructure Systems becomes ZionSiphon Malware Infiltrates Water Infrastructure Systems
Imagine malware that's not just a data thief, but a menacing force that can map and disrupt the very plumbing of a city - that's the alarming reality of ZionSiphon, a malicious tool targeting water infrastructure systems with sabotage and scanning capabilities. This sinister malware can scan, disrupt, and wreak havoc on operational-technology water systems, posing a significant threat to public safety.
Formbook Malware Exploits Obfuscation to Evade Detection
Staying one step ahead of threats just got tougher: Formbook malware's latest campaign combines DLL side-loading and obfuscated JavaScript to expertly evade detection. This sneaky tactic allows it to remain hidden, making it a formidable foe in the cybersecurity landscape.
Malware Campaigns Exploit Trusted Channels for Internal Access
Instead of smashing down the front door, attackers are now sneaking in by exploiting trusted channels and misdirecting trust - a subtle yet effective tactic that's leaving defenders, regulators, and users scrambling to respond. This quiet approach to breaching security is a growing concern, with multiple incidents revealing a common pattern of adversaries using third-party components to gain internal access.
Mirai Botnet Exploits DVR Flaw in TBK Devices
A Mirai-based malware campaign, known as Nexcorium, is actively exploiting a critical vulnerability (CVE-2024-3721) in TBK DVR devices, posing immediate risks to device owners and network defenders. This alarming development raises crucial questions about operational security and cyber risk management.
British Hacker Pleads Guilty to Crypto Theft Charges
A British hacker, allegedly the mastermind behind the notorious Scattered Spider cybercrime collective, has pleaded guilty to wire fraud and aggravated identity theft charges in a US court, dealing a significant blow to the shadowy network. This guilty plea marks a major win for law enforcement and raises important questions about the future of cybercrime and online security.
[SPONSOREDNUBIVANCE]
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverage
Malware Targets Israeli Water Systems with Precision Attacks
A newly discovered malware strain called ZionSiphon is threatening Israeli water systems with precision attacks, leaving experts concerned about the vulnerability of critical infrastructure. This sophisticated code can infiltrate and manipulate the machines that control pumps and filters, putting a city's taps at risk.
Prompt Injection Attacks Target AI Systems with Alarming Frequency
Imagine a simple question that can outsmart a secret-keeping system - it's happening more often than you'd think, as prompt injection attacks use cleverly crafted language to trick AI models into spilling their secrets. By manipulating conversational inputs, these attacks can get supposedly secure AI bots to reveal sensitive information.
Mirai Variant Exploits Flaw in TBK DVRs for Botnet Expansion
Security researchers have uncovered a sneaky tactic where hackers are exploiting vulnerabilities in outdated devices like TBK digital video recorders and TP-Link Wi-Fi routers to spread Mirai-variant malware and grow their botnets. This latest threat highlights the risks of leaving old tech unpatched and unprotected.
Ransomware Exploits QEMU VMs to Evade Endpoint Security
Malicious software can now secretly launch a virtual machine inside your computer, allowing it to evade detection and phone home to its operator - a chilling new tactic that exposes weaknesses in traditional endpoint defenses. This stealthy approach, recently spotted in the Payouts King ransomware, uses the QEMU emulator to create a hidden virtual machine and bypass security measures.
Microsoft Defender Zero-Days Exploited in Active Attacks
Microsoft's top security tool, Defender, has been turned against itself: hackers are exploiting three newly discovered flaws to gain elevated access to already compromised systems, forcing a major rethink of what we thought was safe. This alarming development has defenders, users, and policymakers scrambling to reassess their security assumptions.
FBI and Europol Disrupt Global DDoS-For-Hire Networks
In a major crackdown, the FBI and Europol joined forces to dismantle global DDoS-for-hire networks, seizing infrastructure, detaining suspects, and warning those who've used these malicious services. The operation, dubbed Operation PowerOff, marks a significant blow to those behind these anonymous internet attacks.
Operation PowerOFF Disrupts 53 DDoS Domains, Uncovers 3 Million Criminal Accounts
In a major blow to cybercrime, international authorities have shut down 53 domains used to sell DDoS attacks, disrupting the services of over 75,000 cybercriminals and uncovering a staggering 3 million illicit accounts. This operation marks a significant victory in the fight against digital disruption.
Leaked Windows Zero-Days Exploited in Targeted Attacks
Cyber attackers are exploiting newly disclosed Windows flaws in targeted attacks, allowing them to gain alarming levels of system control before organizations can patch the vulnerabilities. This alarming window of opportunity leaves defenders scrambling to respond.