[SPONSOREDNUBIVANCE]
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageMalware & Ransomware
China-linked hackers impersonate US officials to target AI experts
Phishing campaigns impersonating US officials are targeting top AI policy experts, making it tough for them to know if they're being scammed. Even prominent figures like Lynne Parker have had their names used to trick others, highlighting the challenge of stopping these attacks.
China-Nexus Espionage Campaign Exploits Outlook, OneDrive
A sneaky espionage campaign, tracked as UAT-11587, has been exploiting Microsoft Outlook and OneDrive to secretly control its targets, with a reach that spans 16 entities across eight Asian countries. The sophisticated attack, first detected in September 2025, has been targeting academic, think-tank, and civil-society organizations, with evidence of continued activity through May 2026.
US Treasury Sanctions Tren de Aragua Members Over $40 Million ATM Hacks
The US Treasury Department has cracked down on eight members of the notorious Venezuelan gang Tren de Aragua, sanctioning them for their roles in a brazen $40 million ATM hacking scheme that targeted US bank and credit union machines. Using malicious software, the gang forced ATMs to spit out cash, which was then laundered and transferred to members worldwide.
AI Accelerates Cyber Attacks to Minutes, Microsoft Warns
Microsoft warns that AI is supercharging cyber attacks, condensing what once took days into mere minutes - putting defenders on the back foot and giving attackers a disturbing head start. This alarming acceleration is happening during the most critical phases of an attack, including credential discovery, lateral movement, and data exfiltration.
Browser Attacks Evade Endpoint Telemetry in SaaS-Heavy Environments
In today's SaaS-driven world, a shocking 79% of business apps are accessible only through browsers, creating a blind spot for traditional endpoint security. This makes it alarmingly easy for attackers to launch stealthy browser-based threats that evade detection.
Law Enforcement Disrupts KillSec Ransomware Group with Global Arrests
In a major breakthrough, global law enforcement agencies have joined forces to dismantle the notorious KillSec ransomware group, arresting suspected operators and disrupting their operations. The crackdown, dubbed Operation KillSwitch, targeted the group behind a string of devastating attacks on hospitals, government bodies, and financial institutions.
Zero-Days Exploited in Agentic AI Attack on Dutch Vulnerability Disclosure Institute
In a shocking cyberattack, hackers exploited zero-day vulnerabilities to hijack sessions, run code remotely, and escalate privileges in mere seconds, targeting the Dutch Vulnerability Disclosure Institute, a volunteer-run nonprofit dedicated to ethical vulnerability disclosure. The Institute's own expertise and swift incident response actions ultimately thwarted the attack.
Authorities Disrupt KillSec Extortion Group in Global Operation
In a major breakthrough, law enforcement agencies from 10 countries joined forces to dismantle the notorious KillSec Extortion Group, seizing key infrastructure and arresting three suspects behind the gang's notorious extortion spree that compromised around 500 organizations. This global operation, dubbed "Operation KillSwitch," resulted in the confiscation of 110 terabytes of data and critical servers used by the group.
Fortinet FortiMail Zero-Day Flaw Exploited in Attacks
A critical Fortinet FortiMail flaw, rated CVSS 9.8, is being actively exploited by attackers, allowing them to write arbitrary files to vulnerable systems without needing authentication. This severe vulnerability combines a path traversal and a NULL-byte handling error, making it a high-risk threat.
AI Agents Exploit Zero-Days to Breach Security Research Org
In a shocking and unprecedented attack, malicious actors exploited two unknown flaws in a support platform to breach a leading security research organization, gaining root access in mere seconds. This lightning-fast intrusion has left experts stunned, declaring it an attack unlike any they've seen before.
AI Agents Target US, Canada Government Sites in Data Retrieval Push
On June 17, a swarm of autonomous AI agents launched a massive data retrieval assault on a US Department of Education website, generating over 200,000 requests in a quest for school statistics, including a cleverly crafted attempt at SQL injection. This brazen probe was part of a series of unusual and concerning attacks targeting government sites in the US and Canada.
China-linked group targets US AI policy experts with phishing campaign
A cunning phishing campaign impersonated top US AI policy voices, including a former White House science advisor and a renowned economist, to gain the trust of targeted experts. The attackers carefully crafted initial messages that seemed to invite recipients into an AI policy advisory committee or a report collaboration, slowly building a relationship before making their next move.
Police Disrupt KillSec Ransomware Group, Arrest Suspects Worldwide
In a major cybercrime crackdown, international law enforcement agencies joined forces to dismantle the notorious KillSec Ransomware Group, arresting suspects and seizing key servers, domains, and cryptocurrency wallets. The operation resulted in a massive haul of at least 110 terabytes of data, dealing a significant blow to the group's extortion campaign.
China-Linked Hackers Impersonate AI Experts to Steal US Policy Insiders' Credentials
Beware of fake AI experts trying to trick US policy insiders into handing over their credentials - a China-linked hacker group, TA419, has been impersonating AI authorities to steal sensitive information since at least April 2025. Verify unexpected messages from supposed AI experts through another channel to stay safe.
Law Enforcement Disrupts KillSec Ransomware Gang Led by Teenager
In a major breakthrough, international authorities have successfully disrupted the notorious KillSec Ransomware Gang, led by a teenager, in a coordinated effort dubbed Operation KillSwitch. The operation, backed by Europol and cybersecurity experts, has taken down the gang's servers, dark-web leak site, and seized a staggering 110 terabytes of stolen data.
Microsoft tracks hackers exploiting Zimbra bug before public disclosure
Microsoft detected hackers probing for a Zimbra bug, CVE-2026-73570, just days after it was patched, but before the vulnerability was publicly disclosed - a concerning gap that highlights the need for swift and secretive fixes. The bug, which allows attackers to run commands on exposed mail servers, was exploitable via a specially crafted email.
[SPONSOREDNUBIVANCE]
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
WordPress Backdoor Persists Through Self-Healing Mechanisms
Meet the sneaky WordPress backdoor that refuses to be erased, thanks to its cunning self-healing mechanisms that spread its payload across eight files, the database, and shared memory. This clever malware can rebuild itself from any surviving copy, making it a formidable foe for security experts.
CloudSyncD Backdoor Exploits Zoom Installer to Infiltrate MacOS Systems
Meet CloudSyncD, a sneaky backdoor that's exploiting the Zoom installer to secretly infiltrate MacOS systems. This cleverly disguised malware can masquerade as a legitimate Zoom installer, putting your system at risk.
Star Blizzard Deploys RedFlick Malware via Automated Phishing Attacks
Microsoft warns that Star Blizzard, a Russian state actor, has launched over 13 large-scale phishing campaigns this year, infecting over 100 US and UK organizations with the RedFlick malware. This sneaky tactic installs the CosmicPulse backdoor, showcasing the group's evolving malware and distribution techniques.
Zero-days in Zammad ticketing system enable AI-driven network breach
In a shocking breach, two zero-day vulnerabilities in the Zammad ticketing system were exploited in tandem to hijack sessions, run code remotely, and escalate privileges to root in mere seconds. This devastating chain of attacks was made possible by an autonomous AI agent that enabled attackers to go from limited user access to full control of the host.
Microsoft Warns of Dual-RMM Phishing Attacks Deploying ScreenConnect
Beware of phishing attacks that disguise themselves as legitimate software installs - hackers are using fake filenames to trick you into giving them remote control of your device. Microsoft has uncovered a sneaky campaign that uses a genuine MSP360 installer to gain an initial foothold on affected devices.
Hackers Exploit Zimbra Flaw to Harvest Authentication Secrets
Hackers are actively exploiting a high-severity flaw in Zimbra Collaboration Suite to gain remote access and harvest sensitive authentication secrets. This vulnerability, patched in July 2026, can be triggered by a specially crafted email, making it a critical threat to unprotected servers.
Threat Actors Exploit ChatGPT Custom GPTs in ClickFix Malware Campaign
At least 40 users have fallen victim to a sneaky malware campaign that uses ChatGPT Custom GPT pages and Google Sites to spread a powerful remote access trojan (RAT). Attackers cleverly created fake Custom GPT links that appeared on Google search results, tricking users into downloading the malware.
Cisco SD-WAN Manager Flaw Exploited by Attackers
Cisco's SD-WAN Manager has a critical vulnerability that allows attackers to bypass authentication and access the Manager's API as an admin user without login credentials. This flaw, rated 9.8 out of 10 in severity, is being actively exploited, prompting Cisco to urge immediate upgrades to fixed releases.