[SPONSOREDNUBIVANCE]
Rapid7 deployed right the first time.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deploymentMalware & Ransomware
remote-access trojan Stealthy Risk: Exclusive Alert
Meet MostereRAT: a stealthy remote-access trojan that slips into Windows systems via convincing phishing and then hides using living‑off‑the‑land tactics, process injection and obfuscated code to evade detection. The takeaway: basic hygiene—skepticism about attachments, disabled macros, timely patches and layered visibility—now matters more than ever.
AI-powered ransomware: Risky, Stunning Threat
What happens when a harmless research project turns into a blueprint for crime? The first AI-powered ransomware shows how generative models can automate and personalize attacks, forcing researchers, defenders, and policymakers to rethink openness, oversight, and preparedness.
CastleRAT malware: Exclusive Dangerous C/Python Threat
A new strain of CastleRAT, now rewritten in both C and Python, is being spread via a nasty ClickFix trick that convinces users to paste malicious commands into their terminals—don’t paste commands you don’t trust. Stay skeptical of unsolicited “fixes,” verify sources, and treat pasteable commands like executable attachments.
macOS stealer Exclusive: Dangerous, Must-Stop Threat
Think a cracked app is a harmless shortcut? Trend Micro warns that a macOS stealer called AMOS is being bundled with pirated apps and delivered via terminal commands that grant attackers sweeping access—don’t run unverified installers or command-line scripts, and stick to legitimate software to protect your accounts and networks.
GhostRedirector: Exclusive Dangerous China-Aligned Threat
A newly discovered group called GhostRedirector quietly breached 65 Windows servers using custom tools and stealthy redirection techniques, and its infrastructure and tradecraft point to China-aligned objectives. Treat this as a wake-up call to move beyond signature-based detection, hunt for anomalous behavior, and harden your systems now.
IPTV piracy: Stunning 1,100-Domain Risk Exposed
A massive IPTV piracy ring spanning about 1,100 domains was exposed — offering dirt‑cheap access to Apple TV, Disney+, HBO and Netflix while often exposing viewers to malware, fraud and billions in lost revenue. The takedown shows how convenience and low cost fuel organized piracy that threatens creators, consumers and the whole streaming ecosystem.
Lazarus Group Exclusive: Dangerous DeFi RATs Revealed
A North Korea-linked Lazarus campaign used a crafty phishing lure to deploy three cross-platform RATs—PondRAT, ThemeForestRAT and RemotePE—breaching a DeFi organization and highlighting how attackers now tailor stealthy, multi‑OS toolsets to target decentralized finance. It’s a wake-up call: assume breach, tighten access and key protections, and shift to behavior-based detection across heterogeneous environments.
malicious npm package: Risky Crypto-Theft Exclusive Alert
A malicious npm package posing as the popular nodemailer email library slipped into projects with one line of dependency and carried code designed to siphon cryptocurrency—showing how a single careless install can turn a routine dependency into a financial threat. Audit your dependencies, pin versions, and use supply‑chain tools—convenience shouldn’t cost you your wallet.
Ransomware incidents: Must-Have Resilience or Costly Chaos
Pennsylvania’s Attorney General says “we refused to pay,” choosing to withstand a ransomware attack that has delayed court filings and strained case processing across the state. The decision highlights the painful trade-off between short-term recovery and long-term deterrence—and underscores why public agencies must invest in stronger backups, better defenses, and robust continuity plans.
Salt Typhoon: Exclusive Risky Breach Exposes 600+ Orgs
A China-linked APT called Salt Typhoon has quietly breached over 600 organizations by exploiting Cisco, Ivanti, and Palo Alto flaws—targeting backbone routers and management systems to gain persistent, wide-reaching access. The campaign is a wake-up call to prioritize patching, inventory, and stronger segmentation and logging for every organization that relies on critical network infrastructure.
Salt Typhoon: Exclusive Risky Cyber Threat Exposed
Turns out attackers are going after the little guys—Dutch officials confirm the Salt Typhoon campaign hit small local ISPs, revealing how fragile national connectivity can be. Strengthening affordable security, incident reporting and support for these tiny telcos is now a national priority.
Swedish municipalities Risky Ransomware: Stunning Alert
When a ransomware hit on vendor Miljödata silenced systems for roughly 200 Swedish municipalities and stalled services like waste collection and permitting, officials were forced to choose between a roughly $168K Bitcoin payout and messy recovery efforts. The episode shows how one compromised supplier can grind everyday public life to a halt—and why vendor security must be treated as core civic resilience, not optional overhead.
ransomware incident: Exclusive Alarming Fallout Revealed
Nevada has confirmed a ransomware attack that not only crippled systems but also stole state data, leaving residents and officials scrambling to learn what was taken and who’s at risk. Authorities are investigating with federal partners — anyone concerned should watch for official notifications and take basic precautions like changing passwords and enabling multifactor authentication.
AI-powered ransomware: Stunning New Risk Exposed
ESET just uncovered PromptLock — the first AI-powered ransomware that runs OpenAI’s gpt-oss:20b locally via Ollama to generate bespoke Lua payloads on the fly. It’s a wake-up call: dynamically generated malware can evade signature-based defenses, so teams must lock down local model hosting, boost runtime monitoring, and update incident playbooks.
AI-powered ransomware: Stunning Dangerous Threat
Researchers have uncovered PromptLock, the first known ransomware to use generative AI to craft personalized ransom notes and negotiate with victims—turning a speculative threat into an urgent reality. Its rise shows attackers can automate persuasion, forcing organizations to boost defenses, backups, and incident plans before AI-powered extortion becomes widespread.
AI-powered ransomware: Exclusive Risky Breakthrough
Researchers have uncovered PromptLock, a proof‑of‑concept ransomware that uses an open‑weight LLM to draft highly persuasive extortion messages—currently inactive in the wild but a clear warning that AI can amplify attackers’ social‑engineering tactics. Take it as a wake‑up call: patch, back up, segment networks, and sharpen detection before opportunistic criminals turn this experiment into a real threat.
[SPONSOREDNUBIVANCE]
Know a small business winging it on security?
No IT department, no security budget, real exposure. Nubivance builds right-sized security foundations for small companies. Send them this.
Send it along
Hook Android Trojan: Stunning Dangerous Ransomware Threat
A new Hook Android Trojan variant now combines banking fraud with ransomware-style lockouts, letting attackers both steal credentials and hold phones hostage. Millions of users should tighten app sources, review permissions, and keep backups as defenders scramble to catch up.
MixShell malware: Exclusive Risky Supply-Chain Threat
Attackers behind the ZipLine campaign are skipping noisy phishing emails and weaponizing corporate “Contact Us” forms to trick procurement staff into running an in-memory, fileless loader called MixShell that evades detection and targets U.S. supply-chain manufacturers. Treat unexpected vendor downloads with skepticism, verify requests through known channels, and beef up memory-level detection—because human trust is now a favorite attack vector.
ransomware attack Devastating: Must-Have Supplier Resilience
When Data I/O took systems offline after a ransomware attack, it showed how a single supplier can ripple delays through entire production lines — a wake-up call for manufacturers to shore up supplier cyber-hygiene, backups, and contingency plans before the next outage.
malware-laden Android apps: Stunning Threats Reveal Risk
Got a scary “your phone is infected” pop-up despite downloading from Google Play? A new Zscaler report found over 19 million installs of malware-laden Android apps that slipped past scans via malicious SDKs, repackaging and delayed activation — a reminder to keep apps updated, check permissions, and stay a little skeptical even in official stores.
ransomware attack: Exclusive Risky Lab Disruption
Inotiv has confirmed a ransomware attack that disrupted its lab systems and may have exposed sensitive data, putting drug-development timelines and client projects on hold. The company says it’s working with external cybersecurity experts to investigate and restore operations while clients wait for clarity.
USB-borne campaign: Critical, Risky Cryptominer Threat
A new global USB-borne campaign turns everyday thumb drives into stealthy cryptomining engines by chaining DLL hijacking with PowerShell — quietly draining CPU/GPU power and sidestepping network defenses. Treat unknown USBs as hostile: disable autorun, use scanned maintenance drives, and harden endpoints to block this low‑tech delivery of high‑tech abuse.
Colt Technology Services Devastating Outage Exclusive
A ransomware attack on Colt has left many customers facing prolonged internet and network outages, turning a brief advisory into days of stalled operations, lost revenue and frayed trust. The episode shows how deeply businesses depend on major carriers—and why clearer communication, stronger resilience and tougher safeguards are urgently needed.
ERMAC v30 Exposed: Stunning Risky Banking Threat
A public leak of ERMAC v3.0’s source code has pulled back the curtain on a sharper, more widespread Android banking trojan—revealing both powerful theft techniques and the operators’ sloppy mistakes that could help investigators. It’s a stark reminder that transparency can empower defenders, but also risks giving other crooks a head start if we don’t act fast.