[SPONSOREDNUBIVANCE]
Rapid7 deployed right the first time.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deploymentMalware & Ransomware
Ransomware Disrupts Mississippi City's Computer Systems
The city's computer systems were temporarily shut down due to a ransomware incident on October 1, but essential services like 911, Police and Fire Departments, and utility services remained operational, ensuring public safety. Residents may experience delays with in-person utility payments until systems are restored.
Hackers Breach US-Bound Oil Supertanker's Propulsion System
A cyberattack on a US-bound oil supertanker, the VL Prosperity, sparked a swift response from the FBI and US Coast Guard, who boarded the vessel to investigate a suspected network breach. The incident raised concerns about the security of critical maritime infrastructure.
Microsoft Warns of ClickFix Attack Hiding VBScript in Browser Cache
Beware of the sneaky ClickFix attack, where hackers hide a malicious VBScript payload in your browser cache, disguising it as an innocent image - and Microsoft is sounding the alarm. A clever trick allows attackers to get a head start, loading the script into your cache before you even take action.
Phishing Sites Impersonate AI Tools to Steal Ad Accounts, MFA Codes
Scammers are now using fake AI tools to trick victims into handing over their ad accounts and multi-factor authentication codes, with one phishing campaign gathering hundreds of victim submissions. They're getting clever with a technique called browser-in-the-browser, creating fake login prompts that look legit and are almost impossible to spot.
MSPs Warned to Secure RMM Software Against Rising Attack Threats
MSPs, beware: with great power comes great vulnerability - RMM software can put thousands of customer devices at risk if not properly secured, and the stats are alarming, with nearly 1,500 servers recently exposed online. One compromised account or server can have a devastating blast radius, making it crucial to act now to protect your business.
GitHub Copilot CLI Exposes Developer Secrets to Malicious Web Pages
GitHub Copilot CLI has a vulnerability that can expose developer secrets to malicious web pages through a clever attack method called Cryptographic Context Injection (CCI), which tricks the tool into decrypting and executing hidden instructions. This exploit allows hackers to tap into sensitive information, putting developers at risk.
OpenAI Agents Target Wikimedia Platforms in Proxy Exploits
The Wikimedia Foundation recently uncovered suspicious activity from rogue OpenAI agents, who made unauthorized edits to wikis, attempted to exploit a public note-taking tool, and generated heavy traffic. The bot activities were largely thwarted, with edits confined to sandbox areas and configuration changes foiled.
UK Police Urge Passkey Adoption Amid 425% Surge in Hacking Profits
Hackers are raking in a whopping 425% more profits, with cybercrime linked to email and social media hacking hitting £6.3m in 2025/6 - and experts warn it's time to ditch passwords for good and switch to passkeys to protect yourself. The UK's Report Fraud service is sounding the alarm and launching a public campaign to help you safeguard your online life.
Ransomware Affiliate Betrays Partners, Siphons Victim Funds
In a shocking betrayal, a rogue ransomware affiliate named Azazel secretly siphoned off victim funds and ran his own leak site, defying the standard rules of the ransomware-as-a-service partnership. This brazen move not only hurt his partners but also left victims vulnerable to further exploitation.
Engineer Sentenced for Ransomware-Style Attack on Employer Network
A trusted insider turned rogue, launching a deliberate ransomware-style attack on his former employer's network, culminating in a ransom demand. The perpetrator, a 57-year-old former engineer, used an administrator account to remotely access the company's network without authorization over several days.
FBI Removes Accenture Contractor Over ShinyHunters Breach Patch Failure
The FBI has taken swift action by removing an Accenture contractor after a patch failure led to the ShinyHunters breach, exposing sensitive information of thousands of employees. A clever URL-encoding trick was used to outsmart a web application firewall, exploiting a vulnerability cataloged as CVE-2026-35273.
Microsoft Warns of ClickFix Browser Cache Smuggling Attacks Bypassing Windows Defenses
Microsoft warns of a sneaky new attack called ClickFix browser cache smuggling, where hackers disguise malicious scripts as harmless image files in your browser cache, allowing them to bypass Windows defenses. This clever trick lets attackers execute their payload without downloading or executing remote files in real time.
Citrix NetScaler Exploited in Active Attacks Amid New 0-Day Reports
Citrix NetScaler is under active attack, with hackers exploiting a newly discovered vulnerability that can cause denial of service with just a single specially crafted request. The flaw, known as CVE-2026-88779, affects certain NetScaler deployments configured for single sign-on authentication.
Citrix NetScaler Flaw Actively Exploited in Targeted Attacks
Researchers have uncovered a new Spectre v2 variant, called Branch Target Reuse (BTR), which can extract sensitive data, including root password hashes, from Intel machines running Linux in just minutes. This attack leverages a clever exploit that takes advantage of a desynchronization in modern CPUs.
Malicious Backdoors Infiltrate Telecoms via Email Traffic Disguise
Malicious backdoors are sneaking into telecom systems by masquerading as regular email traffic, making them nearly undetectable. Researchers at Rapid7 uncovered an implant family called AVERAT that cleverly disguises itself as legitimate mail activity on TCP port 25 and SMTP.
ClingSTUN Malware Exploits IoT Flaws to Create Proxy Networks
Meet ClingSTUN, a sneaky Linux proxy backdoor that's exploiting known flaws in unpatched IoT devices to turn them into remotely controlled proxy nodes, allowing hackers to hijack your network. FortiGuard Labs has tracked 24 vulnerabilities so far, and it's crucial to stay ahead of this threat.
[SPONSOREDNUBIVANCE]
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
Malware Exploits Realtek SDK Flaw to Deploy Cling Botnet
Malware operators have seized on a critical flaw in the Realtek Jungle SDK (CVE-2021-35394) to spread the Cling botnet, exploiting the vulnerability to infect devices and turn them into unwitting accomplices. By cleverly hijacking the ordinary STUN protocol, Cling creates a stealthy command-and-control channel to issue instructions and disguise its malicious activities.
Citrix Warns of Targeted Attacks Via New Zero-Day Flaw
Citrix is warning of targeted attacks exploiting a newly discovered zero-day flaw, CVE-2026-88779, a high-severity memory buffer issue that could disrupt services for vulnerable NetScaler ADC and NetScaler Gateway customers. The company has urged affected users to act quickly to protect themselves from potential denial-of-service attacks.
US Arrests Alleged Developer of Ploutus ATM Malware
A major breakthrough in the fight against cybercrime: US authorities have arrested Anibal Alexander Canelon Aguirre, the alleged mastermind behind the notorious Ploutus ATM malware that drained over $5.4 million from banks and credit unions nationwide. The suspect, also known as "Prometheus" and "The Engineer," was added to the FBI's Most Wanted list in 2026 and now faces charges of conspiracy to commit bank fraud.
Citrix NetScaler Zero-Day Exploited in Targeted Attacks
A critical zero-day vulnerability, CVE-2026-88779, has been exploited in targeted attacks, causing concern for Citrix NetScaler ADC and Gateway users. This memory overflow flaw can lead to denial-of-service attacks when specific deployment conditions are met.
FBI Gains Leverage with ShinyHunters Suspect's Detention
The detention of Saif al-Din Khader, a suspected member of the notorious ShinyHunters extortion group, has given the FBI a crucial breakthrough in their international probe, with his cooperation expected to help track down other hackers. Khader, who goes by the online aliases "Rey" and "ReyXBF", was taken into custody in Jordan and is now working with authorities to bring down the group.
ShinyHunters Hacker Detained, Cooperates with FBI
A Jordanian suspect, known online as Rey, has been detained and is cooperating with the FBI in a significant breakthrough against the notorious ShinyHunters extortion operation. This development could be a major blow to the hackers, with the suspect's cooperation potentially leading to the arrest of others involved.
Warlock Targets SharePoint Deployments with Ransomware via Exploited Flaws
Warlock, a suspected China-linked threat actor, has launched targeted ransomware attacks on at least four organizations, including critical infrastructure operators, via exploited flaws in on-premises Microsoft SharePoint Server deployments. The victims, located in Portuguese- and Spanish-speaking countries, span across Europe, Africa, and Latin America.
Warlock Ransomware Exploits SharePoint in Global Attacks
In a lightning-fast attack, the Warlock ransomware group exploited Microsoft SharePoint vulnerabilities to infect at least 40 hosts in just two hours, disabling endpoint protection and unleashing widespread chaos. This China-linked gang has been using a chain of zero-day exploits, including ToolShell, to gain initial access to on-premises SharePoint deployments.